be14927734e93145a58b75e8f08f0b7859b564f391eaf2a38c8009df35a5b74a

Analysis

user interaction
yes
max time kernel
56s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Size 18.0MB
Sample260811-ws2cdayapc
SHA256 be14927734e93145a58b75e8f08f0b7859b564f391eaf2a38c8009df35a5b74a
MD5 c0e731354e06a00fffce096a0af82f0f
SHA1 167fe5b63543bb99b3a020e2847d921ed891393b
SHA512 7393a0783cc234d4a7817f4691e185f2dc2e6db11bb806bf9edd426c6a05fc79f6f7e1c29f0ff02cc91efefa93ce8d048f4b12f47dc1b62b5abab6d347a26ff3
SSDEEP 393216:SWf2Rwsjw/366awJk7TpTMIahJ3larp03/h36uVVvGKGZAtRycFwP:Sn+sjw/nk7TpTMlVarypKubvGKGZAtRK
TLSH
T14917333398615232EBF10473B42496303D6CE3241B5199AAE3C4FD2D6E394D1A6FB76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{16f2f169-33c8-4018-be08-aec17e5055f1} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{16f2f169-33c8-4018-be08-aec17e5055f1}\\ProfitStarsDeviceControlLauncher.exe\" /burn.runonce"	ProfitStarsDeviceControlLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{16f2f169-33c8-4018-be08-aec17e5055f1} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{16f2f169-33c8-4018-be08-aec17e5055f1}\\ProfitStarsDeviceControlLauncher.exe\" /burn.runonce"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DeviceControlShortcutStartup = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Jack Henry & Associates\\EPS Device Control.lnk\""	EPS.Devices.WPFServiceHost.App.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	EPS.Devices.WPFServiceHost.App.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	EPS.Devices.ClientNstall.App.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIDE26.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE04A.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d65a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5AA.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6703.tmp-\EPS.Devices.Wix.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6703.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6703.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\Installer\e58d656.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d656.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5AA.tmp-\EPS.Devices.Wix.CustomActions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI663.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5AA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE5AA.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4810.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6703.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4666EF01-B0DD-47BD-9374-081C3B291E4D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE9A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI687B.tmp	msiexec.exe

Executes dropped EXE 8 IoCs

pid	Process
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3708	ProfitStarsDeviceControlLauncher.exe
836	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
4744	EPS.Devices.WPFServiceHost.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3244	EPS.Devices.WPFServiceHost.App.exe
3028	EPS.Devices.WPFServiceHost.App.exe

Loads dropped DLL 64 IoCs

pid	Process
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
3608	MsiExec.exe
3608	MsiExec.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4952	rundll32.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
3608	MsiExec.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3172	EPS.Devices.ClientNstall.App.exe
3244	EPS.Devices.WPFServiceHost.App.exe
3244	EPS.Devices.WPFServiceHost.App.exe
3244	EPS.Devices.WPFServiceHost.App.exe
3244	EPS.Devices.WPFServiceHost.App.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\03F2E7756F1213C1154CF1AEF4EEDAC750E343FD\Blob = 03000000010000001400000003f2e7756f1213c1154cf1aef4eedac750e343fd0b000000010000002e0000004500500053002000440065007600690063006500200043006f006e00740072006f006c00200053005300430000000200000001000000dc0000001c0000006c00000018000000200000000000000000000000010000007b00420033003500370045003700410043002d0031004100330038002d0034003800390031002d0041003600390034002d003900340033003800430039004300380042003300420041007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000020000000010000000f0300003082030b308201f3a00302010202108d7bb7bb3a69774ab32c9757443be4a2300d06092a864886f70d01010d050030143112301006035504030c096c6f63616c686f7374301e170d3236303831313030303030305a170d3339313233313034343432385a30143112301006035504030c096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100d086eef316168bf3ac12d19afa3009b65441844ba06942f41cd1619cc4a3fbf252ebd51e40f7cb9d79e9c822e8a85f924e62d873a096e5ded892c3d5578af3d11eab2a4d10db1aeda5e284063691ea981f407bed0de674ef67b8eef2bb175a2b719ee51542af24ffefba53004195bffe93bc2c29692a30d6303a7efb227f020890c3dfa7157e901a0905383c39d941cda9f0e9a54413df26e0d368872db78258bc7bf39368514fe499006cbb1c14ccb7e794f77dafa901bae002ba5af31e8724c5c829ec7b7a85376412b63dcc39e561dd59f36ed4fe38ba2853214d401585a6b71425c0fd965992054d53302164e6ac49a64858abea46f80ce0714b296e09810203010001a3593057300b0603551d0f0404030202b430130603551d25040c300a06082b0601050507030130140603551d11040d300b82096c6f63616c686f7374301d0603551d0e041604140dd676be2d521008dff6f472748a46f7d71da620300d06092a864886f70d01010d0500038201010037aca7f956eced8c27ead208e24b0bdfeb3755ec83f602253fefd164c6ae3e9c5127675e5f39c47591b37243faf17feaf38eee09799b290a2b3f5e4bc11be31f383b98b7020aa211ffdc9e59ab7f41e802397b9a77b257c3816b8459029a5975c095eb67f9a9f44977786a89545ebe1c8efdb59cb8e95cc28d481685befc8c7935239fa67a055e78494ca1661764124cc588e61c9490668a3850e0c10a01b4f8317252bda3b9b3d28f75622fd320b97d2f8f0f03653a65f0c2af7a96ff7fcdf935d0faf5b8d8101edafa1d47170e2c9f091683caa23a215354dd3c4e8d25da4455b83e0ebe97a0c920c67c24086a26e2c1d2a029e26b3864afac1991c241e9b2	EPS.Devices.ClientNstall.App.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\03F2E7756F1213C1154CF1AEF4EEDAC750E343FD\Blob = 04000000010000001000000032eb6a261155da69965d8f0f72f643c60f000000010000004000000051ec39047ff2431090e354aad120cbffea84dd607ff712e1295b6883bb107133e2415657d98ccaf008f5a361e5c664281c8e5e7ab4138f8cc93ea1fca890260c1400000001000000140000000dd676be2d521008dff6f472748a46f7d71da62019000000010000001000000016c70e0a3bff6ad296e0c329e4b9475503000000010000001400000003f2e7756f1213c1154cf1aef4eedac750e343fd5c00000001000000040000000008000020000000010000000f0300003082030b308201f3a00302010202108d7bb7bb3a69774ab32c9757443be4a2300d06092a864886f70d01010d050030143112301006035504030c096c6f63616c686f7374301e170d3236303831313030303030305a170d3339313233313034343432385a30143112301006035504030c096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100d086eef316168bf3ac12d19afa3009b65441844ba06942f41cd1619cc4a3fbf252ebd51e40f7cb9d79e9c822e8a85f924e62d873a096e5ded892c3d5578af3d11eab2a4d10db1aeda5e284063691ea981f407bed0de674ef67b8eef2bb175a2b719ee51542af24ffefba53004195bffe93bc2c29692a30d6303a7efb227f020890c3dfa7157e901a0905383c39d941cda9f0e9a54413df26e0d368872db78258bc7bf39368514fe499006cbb1c14ccb7e794f77dafa901bae002ba5af31e8724c5c829ec7b7a85376412b63dcc39e561dd59f36ed4fe38ba2853214d401585a6b71425c0fd965992054d53302164e6ac49a64858abea46f80ce0714b296e09810203010001a3593057300b0603551d0f0404030202b430130603551d25040c300a06082b0601050507030130140603551d11040d300b82096c6f63616c686f7374301d0603551d0e041604140dd676be2d521008dff6f472748a46f7d71da620300d06092a864886f70d01010d0500038201010037aca7f956eced8c27ead208e24b0bdfeb3755ec83f602253fefd164c6ae3e9c5127675e5f39c47591b37243faf17feaf38eee09799b290a2b3f5e4bc11be31f383b98b7020aa211ffdc9e59ab7f41e802397b9a77b257c3816b8459029a5975c095eb67f9a9f44977786a89545ebe1c8efdb59cb8e95cc28d481685befc8c7935239fa67a055e78494ca1661764124cc588e61c9490668a3850e0c10a01b4f8317252bda3b9b3d28f75622fd320b97d2f8f0f03653a65f0c2af7a96ff7fcdf935d0faf5b8d8101edafa1d47170e2c9f091683caa23a215354dd3c4e8d25da4455b83e0ebe97a0c920c67c24086a26e2c1d2a029e26b3864afac1991c241e9b2	EPS.Devices.ClientNstall.App.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProfitStarsDeviceControlLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EPS.Devices.WPFServiceHost.App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProfitStarsDeviceControlLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EPS.Devices.WPFServiceHost.App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProfitStarsDeviceControlLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EPS.Devices.ClientNstall.App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EPS.Devices.WPFServiceHost.App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309457330653166"	EPS.Devices.ClientNstall.App.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{16f2f169-33c8-4018-be08-aec17e5055f1}\Dependents\{16f2f169-33c8-4018-be08-aec17e5055f1}	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{16f2f169-33c8-4018-be08-aec17e5055f1}\Dependents	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\Dependents	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\ = "{4666EF01-B0DD-47BD-9374-081C3B291E4D}"	ProfitStarsDeviceControlLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{16f2f169-33c8-4018-be08-aec17e5055f1}	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\Version = "5.10.9475.26330"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\DisplayName = "EPS Device Control MSI"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\Dependents\{16f2f169-33c8-4018-be08-aec17e5055f1}	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\Version = "5.10.9475.26330"	ProfitStarsDeviceControlLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\DisplayName = "EPS Device Control MSI"	ProfitStarsDeviceControlLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\Dependents\{16f2f169-33c8-4018-be08-aec17e5055f1}	ProfitStarsDeviceControlLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{16f2f169-33c8-4018-be08-aec17e5055f1}\ = "{16f2f169-33c8-4018-be08-aec17e5055f1}"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{16f2f169-33c8-4018-be08-aec17e5055f1}\Version = "5.10.9475.26330"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{16f2f169-33c8-4018-be08-aec17e5055f1}\DisplayName = "EPS Device Control"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}\ = "{4666EF01-B0DD-47BD-9374-081C3B291E4D}"	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Installer\Dependencies\{4666EF01-B0DD-47BD-9374-081C3B291E4D}	ProfitStarsDeviceControlLauncher.exe

Modifies system certificate store 2 TTPs 14 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\0DD676BE2D521008DFF6F472748A46F7D71DA620	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\03F2E7756F1213C1154CF1AEF4EEDAC750E343FD	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CTLs	EPS.Devices.ClientNstall.App.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates\BE43DB6CFBF51E71FDC6BA948EFCEFA5C9289896\Blob = 030000000100000014000000be43db6cfbf51e71fdc6ba948efcefa5c92898960b000000010000002e0000004500500053002000440065007600690063006500200043006f006e00740072006f006c002000530053004300000002000000010000001c0100001c000000ac0000001800000020000000000000000000000001000000660037006300360061003400320034003600660062003800310039003800650030003300330038006100320033003500620063006600330033006200610062005f00310033003800370065003700320064002d0036006500660030002d0034006400360066002d0039006400350035002d006100320036003800320033003000610030003300330031000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000002000000001000000520300003082034e30820236a00302010202102906e9405b1236a54fa023d1afda4b5e300d06092a864886f70d01010d050030143112301006035504030c096c6f63616c686f7374301e170d3236303831313138303533335a170d3237303831313138323533335a30143112301006035504030c096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100d086eef316168bf3ac12d19afa3009b65441844ba06942f41cd1619cc4a3fbf252ebd51e40f7cb9d79e9c822e8a85f924e62d873a096e5ded892c3d5578af3d11eab2a4d10db1aeda5e284063691ea981f407bed0de674ef67b8eef2bb175a2b719ee51542af24ffefba53004195bffe93bc2c29692a30d6303a7efb227f020890c3dfa7157e901a0905383c39d941cda9f0e9a54413df26e0d368872db78258bc7bf39368514fe499006cbb1c14ccb7e794f77dafa901bae002ba5af31e8724c5c829ec7b7a85376412b63dcc39e561dd59f36ed4fe38ba2853214d401585a6b71425c0fd965992054d53302164e6ac49a64858abea46f80ce0714b296e09810203010001a3819b308198300e0603551d0f0101ff0404030202b430130603551d25040c300a06082b0601050507030130140603551d11040d300b82096c6f63616c686f7374301d0603551d0e041604140dd676be2d521008dff6f472748a46f7d71da620303c060a2b0601040182370a0b0b042e4500500053002000440065007600690063006500200043006f006e00740072006f006c0020005300530043000000300d06092a864886f70d01010d05000382010100a5210b589dc3c7aee2343a54aba37f2ec75cee4fd59466f34eb1cd9937951dbbba53325de74adb3258e4ea5224d2888f421986bd8f8e3624e155b37018fc829c3354f7d9e82c0d565f79f60023ad3a272b10e4e57e2937b3b3f1c0b36b1fab6514ea97792e78c9cd4c4e409e640b096a88c465a3d5bf8750922e8edc027709d463e63e2e7aa56b358106c5b29c92075e8210c1aafec1bb7e76580d440179b77c25214e3ecb3ecd545a9bd7e132d5a6e78888986712c487b41390e7b2ccae0c1d9b4ee360c5dac85509faee73d9b6dc01d47c15a5f4c4a8754427d1ffc2378a993c04a005e96ec460ab46af2368450d5cdd35f0dc9a799e3eb1b14ac0cc6b5774	EPS.Devices.ClientNstall.App.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\03F2E7756F1213C1154CF1AEF4EEDAC750E343FD\Blob = 04000000010000001000000032eb6a261155da69965d8f0f72f643c60f000000010000004000000051ec39047ff2431090e354aad120cbffea84dd607ff712e1295b6883bb107133e2415657d98ccaf008f5a361e5c664281c8e5e7ab4138f8cc93ea1fca890260c1400000001000000140000000dd676be2d521008dff6f472748a46f7d71da62019000000010000001000000016c70e0a3bff6ad296e0c329e4b9475503000000010000001400000003f2e7756f1213c1154cf1aef4eedac750e343fd5c0000000100000004000000000800000b000000010000002e0000004500500053002000440065007600690063006500200043006f006e00740072006f006c002000530053004300000002000000010000001c0100001c000000ac0000001800000020000000000000000000000001000000660037006300360061003400320034003600660062003800310039003800650030003300330038006100320033003500620063006600330033006200610062005f00310033003800370065003700320064002d0036006500660030002d0034006400360066002d0039006400350035002d006100320036003800320033003000610030003300330031000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f007600690064006500720000000000000047000000010000001200000058007700660070007300660072007700000020000000010000000f0300003082030b308201f3a00302010202108d7bb7bb3a69774ab32c9757443be4a2300d06092a864886f70d01010d050030143112301006035504030c096c6f63616c686f7374301e170d3236303831313030303030305a170d3339313233313034343432385a30143112301006035504030c096c6f63616c686f737430820122300d06092a864886f70d01010105000382010f003082010a0282010100d086eef316168bf3ac12d19afa3009b65441844ba06942f41cd1619cc4a3fbf252ebd51e40f7cb9d79e9c822e8a85f924e62d873a096e5ded892c3d5578af3d11eab2a4d10db1aeda5e284063691ea981f407bed0de674ef67b8eef2bb175a2b719ee51542af24ffefba53004195bffe93bc2c29692a30d6303a7efb227f020890c3dfa7157e901a0905383c39d941cda9f0e9a54413df26e0d368872db78258bc7bf39368514fe499006cbb1c14ccb7e794f77dafa901bae002ba5af31e8724c5c829ec7b7a85376412b63dcc39e561dd59f36ed4fe38ba2853214d401585a6b71425c0fd965992054d53302164e6ac49a64858abea46f80ce0714b296e09810203010001a3593057300b0603551d0f0404030202b430130603551d25040c300a06082b0601050507030130140603551d11040d300b82096c6f63616c686f7374301d0603551d0e041604140dd676be2d521008dff6f472748a46f7d71da620300d06092a864886f70d01010d0500038201010037aca7f956eced8c27ead208e24b0bdfeb3755ec83f602253fefd164c6ae3e9c5127675e5f39c47591b37243faf17feaf38eee09799b290a2b3f5e4bc11be31f383b98b7020aa211ffdc9e59ab7f41e802397b9a77b257c3816b8459029a5975c095eb67f9a9f44977786a89545ebe1c8efdb59cb8e95cc28d481685befc8c7935239fa67a055e78494ca1661764124cc588e61c9490668a3850e0c10a01b4f8317252bda3b9b3d28f75622fd320b97d2f8f0f03653a65f0c2af7a96ff7fcdf935d0faf5b8d8101edafa1d47170e2c9f091683caa23a215354dd3c4e8d25da4455b83e0ebe97a0c920c67c24086a26e2c1d2a029e26b3864afac1991c241e9b2	EPS.Devices.ClientNstall.App.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\0DD676BE2D521008DFF6F472748A46F7D71DA620\Blob = 02000000000000001c0100001c000000ac0000001800000020000000000000000000000001000000660037006300360061003400320034003600660062003800310039003800650030003300330038006100320033003500620063006600330033006200610062005f00310033003800370065003700320064002d0036006500660030002d0034006400360066002d0039006400350035002d006100320036003800320033003000610030003300330031000000000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000520053004100200061006e00640020004100450053002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072000000000000002300000000000000140000000dd676be2d521008dff6f472748a46f7d71da620	EPS.Devices.ClientNstall.App.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates\BE43DB6CFBF51E71FDC6BA948EFCEFA5C9289896	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\CRLs	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\REQUEST\Certificates\BE43DB6CFBF51E71FDC6BA948EFCEFA5C9289896	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\03F2E7756F1213C1154CF1AEF4EEDAC750E343FD	EPS.Devices.ClientNstall.App.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\03F2E7756F1213C1154CF1AEF4EEDAC750E343FD	EPS.Devices.ClientNstall.App.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3608	MsiExec.exe
3608	MsiExec.exe
2868	msiexec.exe
2868	msiexec.exe
4476	MsiExec.exe
4476	MsiExec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
3660	ProfitStarsDeviceControlLauncher.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe
2868	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeIncreaseQuotaPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeSecurityPrivilege	2868	msiexec.exe
Token: SeCreateTokenPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeAssignPrimaryTokenPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeLockMemoryPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeIncreaseQuotaPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeMachineAccountPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeTcbPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeSecurityPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeTakeOwnershipPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeLoadDriverPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeSystemProfilePrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeSystemtimePrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeProfSingleProcessPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeIncBasePriorityPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeCreatePagefilePrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeCreatePermanentPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeBackupPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeRestorePrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeShutdownPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeDebugPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeAuditPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeSystemEnvironmentPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeChangeNotifyPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeRemoteShutdownPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeUndockPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeSyncAgentPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeEnableDelegationPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeManageVolumePrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeImpersonatePrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeCreateGlobalPrivilege	3636	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe
Token: SeRestorePrivilege	2868	msiexec.exe
Token: SeTakeOwnershipPrivilege	2868	msiexec.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe
4744	EPS.Devices.WPFServiceHost.App.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	LogonUI.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 3636	3204	ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe	84
PID 3708 wrote to memory of 836	3708	ProfitStarsDeviceControlLauncher.exe	95
PID 836 wrote to memory of 3660	836	ProfitStarsDeviceControlLauncher.exe	97
PID 2868 wrote to memory of 3608	2868	msiexec.exe	98
PID 3608 wrote to memory of 4952	3608	MsiExec.exe	104
PID 4952 wrote to memory of 4744	4952	rundll32.exe	105
PID 4744 wrote to memory of 3172	4744	EPS.Devices.WPFServiceHost.App.exe	107
PID 3172 wrote to memory of 2840	3172	EPS.Devices.ClientNstall.App.exe	109
PID 3172 wrote to memory of 4296	3172	EPS.Devices.ClientNstall.App.exe	112
PID 3172 wrote to memory of 4760	3172	EPS.Devices.ClientNstall.App.exe	114
PID 3172 wrote to memory of 2920	3172	EPS.Devices.ClientNstall.App.exe	116
PID 2868 wrote to memory of 4476	2868	msiexec.exe	118
PID 3172 wrote to memory of 1588	3172	EPS.Devices.ClientNstall.App.exe	120
PID 3172 wrote to memory of 3244	3172	EPS.Devices.ClientNstall.App.exe	122
PID 3172 wrote to memory of 2108	3172	EPS.Devices.ClientNstall.App.exe	124
PID 3172 wrote to memory of 1060	3172	EPS.Devices.ClientNstall.App.exe	126
PID 4744 wrote to memory of 3928	4744	EPS.Devices.WPFServiceHost.App.exe	128
PID 4744 wrote to memory of 3612	4744	EPS.Devices.WPFServiceHost.App.exe	130
PID 4476 wrote to memory of 1068	4476	MsiExec.exe	140
PID 1068 wrote to memory of 3028	1068	rundll32.exe	141

C:\Users\Admin\AppData\Local\Temp\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
"C:\Users\Admin\AppData\Local\Temp\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\Temp\{16851E20-BD01-49AA-BBB8-93D55C309E72}\.cr\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
  "C:\Windows\Temp\{16851E20-BD01-49AA-BBB8-93D55C309E72}\.cr\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe" -burn.filehandle.attached=668 -burn.filehandle.self=664
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3C7B9160EADEC444E83DD83EB862187
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIE5AA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240706984 7 EPS.Devices.Wix.CustomActions!JHA.EPS.Devices.Wix.CustomActions.CustomActions.LaunchDeviceControl
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe
      "C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe"
      4⤵
      Adds Run key to start application
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.ClientNstall.App.exe
        
        "C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.ClientNstall.App.exe" /Onyx /OtherSettings
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Modifies trusted root certificate store through registry
        System Location Discovery: System Language Discovery
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:3172
      - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://+:37121/ user=\Everyone
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2840
      - C:\Windows\SysWOW64\netsh.exe
        
        "C:\Windows\System32\netsh.exe" http add urlacl url=https://+:37131/ user=\Everyone
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4296
      - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http delete sslcert ipport=0.0.0.0:37121
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4760
      - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http delete sslcert ipport=0.0.0.0:37131
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2920
      - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http show sslcert ipport=0.0.0.0:37121
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1588
      - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http add sslcert ipport=0.0.0.0:37121 appid={b674c0af-2aa7-4451-b9f4-cc7379fab63f} certhash=03F2E7756F1213C1154CF1AEF4EEDAC750E343FD certstorename=Root
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3244
      - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http show sslcert ipport=0.0.0.0:37131
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2108
      - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http add sslcert ipport=0.0.0.0:37131 appid={b674c0af-2aa7-4451-b9f4-cc7379fab63f} certhash=03F2E7756F1213C1154CF1AEF4EEDAC750E343FD certstorename=Root
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1060
    - - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http show sslcert ipport=0.0.0.0:37121
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3928
    - - C:\Windows\SysWOW64\netsh.exe
        
        "netsh" http show sslcert ipport=0.0.0.0:37131
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 326B276C03501DBD12E418362717B2DF
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI6703.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740109 19 EPS.Devices.Wix.CustomActions!JHA.EPS.Devices.Wix.CustomActions.CustomActions.LaunchDeviceControl
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe
      "C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3028

C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe
"C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\EPS_Device_Control_20260811191510.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{16f2f169-33c8-4018-be08-aec17e5055f1}\ProfitStarsDeviceControlLauncher.exe" -burn.filehandle.attached=648 -burn.filehandle.self=668 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\EPS_Device_Control_20260811191510.log"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:3660

C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe
"C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4840

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38f9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58d659.rbs

Path C:\Config.Msi\e58d659.rbs
Size 24KB
SHA256 4690b5b518189ee8eeb6425e9a4da7e65851f8c4c55359e98072fb75cfd4d20c
MD5 15b9574638e73bf0d07a443301cb914d
SHA1 f591f8f8a09c98618a0039fcb5aee929fd14852e
SHA512 4442e6bd04d90bd94aed35ed72660a66a7a0f62c036923abd5a7af5d20caa3733b7d5e753bc906e2b330cb55dabf6c5b6789d8cdcb1874453bb5b64effee6516
SSDEEP 384:zUnTXmQwQ6jgBF7KedfY1EjKTEjKcBTq39797N:zUrdwt8BFXY1EjwEj4N797N
TLSH
T120B27402E998C8E7D761233F2FE7F66D827569425F813A57C38FD414CBC2A8A98C4395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d65d.rbs

Path C:\Config.Msi\e58d65d.rbs
Size 41KB
SHA256 da4bf32be4bfb480b1b26fa32d96aa989275179bf6b8b8cca191dbc5910fb1a6
MD5 ef2ab875ae2230360cc2a2f5b944f53d
SHA1 aca4405a549b8f65b0c793196e35d6fa984c36a3
SHA512 a7ad148ac55825ceef109cedf6e523692650166f4c82898ab6cbe6b386783482581b4ddfc15de49bf78da9244a64132fcaba32d573a7459f895b83e9b18f0977
SSDEEP 384:kv6ifWS3QM0Fyo/LV8n27Mhf6KQ1/Rl3/9GoBTqoBTq3Nb7N:kySAM6/mXY1r9GBB9b7N
TLSH
T1B4130D03A6AE84F7D351233B3BA3676EDE225E011DA21596C37FD51CCB67ACA6CC0509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d6a7.rbf

Path C:\Config.Msi\e58d6a7.rbf
Size 912B
SHA256 6e136684a4eb32ad9fd0dda030dd51da928a564199728a9d0e3cd498b2ce14e9
MD5 c9f7fbd1ee43d1443788d892eff61913
SHA1 4916d2ea6cf0a79c02ac684e85bb9874ffba4110
SHA512 5c9fd7f08d9a2dcbd90268eaa8eb87ec211e6490d7b1a39c9cb72df2e98708dc553b53ecdb805fec88a8e5f5e8504755a5efdd48120c149207449b497e76b4ec
TLSH
T1CB1184EBA51F023ECA2A9E2967D2908166371F82116A37C16434C47C3C2E88C0662821
MD5 SHA1 SHA512 TLSH

Submit Download

f7c6a4246fb8198e0338a235bcf33bab_1387e72d-6ef0-4d6f-9d55-a268230a0331

Path C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f7c6a4246fb8198e0338a235bcf33bab_1387e72d-6ef0-4d6f-9d55-a268230a0331
Size 2KB
SHA256 fdf7528df4c237c50ff47c2c0531abdf7628772afe188dcaa40825c1832f7718
MD5 088609b52d2eeda909cf205106372617
SHA1 bf47cbd59203221c22c532d0b36875d23e4cf89e
SHA512 17959833047c537e26dfceab9946dfb47db859b5714271e3c9bb9b0b673910bf23719dc7e63db3c9cc3c7fab7b5de7f82f5a7306f0e7a67e717fa612f9899738
TLSH
T15E4129D1B56C1063F4A8A2B2CE3F1D814A01FD32A315A3E47228F16901B74F022BCF89
MD5 SHA1 SHA512 TLSH

Submit Download

EpsDeviceControlMsi

Path C:\Users\Admin\AppData\Local\Package Cache\.unverified\EpsDeviceControlMsi
Size 15.7MB
SHA256 370eba066932111383f3e75d78c59f5548066f5bab2f60ad5d718f52828e6094
MD5 b5bd3b1b8000ffdc454543a2780b239c
SHA1 a554f7784ab38bddf0bb8406e12c07dae9a9c7a6
SHA512 c817960d35fd5bb24b5c710e3be3a3b1884c85d137f628e739a5c16c3d991eaef01dedaa41412f3c5c137a5b659efa73539568e5248e4411e05c806855d33822
SSDEEP 393216:n/a8YjrlzM5M8bRR8IOODmcA6ga95itDRjfzwz:n/a8sa5M8bRSqmc5bGRj
TLSH
T16EF63313B5E68637EAFA0939452482347DADBD600B22C99DE398361D9D341D0E3B5F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AxInterop.RANGERLib.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\AxInterop.RANGERLib.dll
Size 28KB
SHA256 487005985ec32ab01485a840abc600a51ac9a318efc0b72933a27c7450e51ab4
MD5 bccac4e75f09c894c9e616167db1d374
SHA1 cf2fdfcefa3a5f81df285224eea1ba6c01eee0f8
SHA512 c147dc0ef1725c9c8ae32da9d7ca0f1e0b11a902928d7d4fe37cfbfe6dc89fc77ac5abf73c4a7d5c1c0e64eb6285241e203a5d051db4ab7b92ba6c6315f9c01b
SSDEEP 768:IT3g+q2/3zn8XifKmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmD4lEjm5Cz:ITBV/3zn8XifKmmmmmmmmmmmmmmmmmmS
TLSH
T157D271066BD00F73C5E6C6F4E5F54102A778FC818103EB8F140455BAE4A7B999EA36EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CsdScan.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\CsdScan.dll
Size 86KB
SHA256 9bfe5057a8f4988567f666d2e236484142f0ac60f57dd45bc7145ed1df6b9e93
MD5 6acbe21adede9c277e2c9ba221b352e2
SHA1 ea20fa93972f1dde9017bafe2167ff9ba320c603
SHA512 af87126f09a0cf4ca70da25de9f92e4b89ed0d02728be051d4c980cd1287e9053d2a1dc8fb63ad4ef85e19c22c58c21db065aefb713a7b6ec21383a1a43d5f98
SSDEEP 1536:GvI4IZwPadUjsdyHlDQbHfkv0lgW/sbcIiYksWjcde/6JSKC0gh:GvI4IZwPaExRT8lgW/sDiYLHsKCH
TLSH
T1FB836B0173E08271E0A38E3195789F85476EBC619B71D9C77398260D5DB87E0AF39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DocProc.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\DocProc.dll
Size 237KB
SHA256 91a0cbae1645c40b25d5ab50b7da9237fe1073e62bd91050adaf24ca2923c08b
MD5 ebf1035625b8e898f8e995707bb6edbb
SHA1 9f5255d9b16974a161977407820b189834698780
SHA512 1fbc7e374484132d2c40bd83d87e6ecdd849d2c40b0efb70c22da9707ff385ca5214c7c42932c2ebca0b731d863880cba18f5c43ccd8f089dde7efceca317ea1
SSDEEP 3072:52I+IebNn0uUDa/iLPRgOX4bi7nTjucMnft71aq7FB0+Ki1VDug5Bk0gb7eKk:j88obCnTjgft7L7FqMDuwk
TLSH
T19A344B80F68AF4B3DD9A09B952AACBB116B94130532896CBF7C70F7D1C741D0A93619F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.Abstraction.Library.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.Abstraction.Library.dll
Size 500KB
SHA256 375ac99bcd7a5f6307d72db59f1c7231608ad5ae4ebab9402df31e89ffc177ea
MD5 754c76d2113a2a43fd90a416fbbb7c6e
SHA1 78bed47520b54b597c8747f7cfcc3f08758ba57a
SHA512 5b02716350b39684814504f9ba4f65d669f4e63025822233f9ad2bbf85dc4f1cca7277e0511bd603fc6dffc97bb4970a059437195eacf23c8b98aaf4a361d703
SSDEEP 6144:keMLCj3VWW3OZM8Aji8XPBfaTuBdFAqI1GVIrJYh:sL4B3OZM3Jaae
TLSH
T165B4D41163E81A19F9BB1775A6B20A068F71F8AB5935D34C328E515F0F72B808C53BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.ClientNstall.App.exe

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.ClientNstall.App.exe
Size 10.4MB
SHA256 40de932d89e9f6224eedab360d43913716d44c84c9fac1d7de16aeeb2af6092a
MD5 d24b711bc087b2a32b5b2da9aab0bc50
SHA1 0c39204202122a2122cbcfc885b73f0416bdef46
SHA512 41c50fd26564a2cd1d6240e4beb8c790f3217af759e5b7affada74c1fb57dc4f9c3dfde93f2e3cbb014b025493ee54fb3dcc8de5a11338de9c6994a103f03c65
SSDEEP 98304:7Mh7cNltAP1lerp6JcRrZwYXOWdUAPmIIbVkhTGf0Zz6Lp2EeIeuj:S7zHMp6GwY+iUmaCTGfc+d2t7uj
TLSH
T1FBB6BF17F700666AC8A8473401C7CB243F7A5C2556BA9223377E2E7E3DB77A05E31A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.ClientNstall.App.exe.config

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.ClientNstall.App.exe.config
Size 1KB
SHA256 7f7f22ecbc366c2489a8386bfa5486735b5f1fd93cf9b8d9847d1898744e2e3c
MD5 a9c69a4547c2cd75cc65b2ecc511b4d7
SHA1 81375027670d86f60ebcd2d14a148636b1ee7725
SHA512 a9c41d16c544b027ef1e0f41fc9f5fa3a020a1946b46243d50b8a3bf62e184bb977114a267aa377b43fe60b20fb068497f247504f448bf50e61cffdb382c878d
TLSH
T1292138326AC4A8A689704E07FE215C52EA2543561686184970AF213FDFE3C4F97971E3
MD5 SHA1 SHA512 TLSH

Submit Download

EPS.Devices.Common.Library.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.Common.Library.dll
Size 126KB
SHA256 5b4aa54f5799fe715c436fab86f4c39be2a2755ced52f0f79b7833e836afabf1
MD5 efbc557e2b0cd133ec4f7aa5328dd897
SHA1 624da9c56bd02e50966ed0c4f031d7f63cfbfa8d
SHA512 80a3e19befdeb0e6b76c3d5274fdec150959a71784aeda9dc98a018980574424f734a5e9a91e2342879fab16a0b7b175377a4a86f2d347b6d19130584f16def6
SSDEEP 3072:Mc3Go0q3V3lYj8jd0fXqpGnaxREEe5dRKMNZqDK:Mc2N4V1vJ0fXBRqD
TLSH
T1A9C3E90037FC8A29F1FE6B356672511107B6F90B7931EA1E1B85A15E0E72B42CA50FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.Service.Library.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.Service.Library.dll
Size 306KB
SHA256 c2df712c0bddeab31460a5819859cc765321a2056fc57333e063669dd5c8c046
MD5 9f6ba2671876129c707f906e75cc6566
SHA1 e1c83042c4c112656d66905d39c7447ff459f45a
SHA512 50b43b3b9bbdaa070c3c4a0b07206269912968ea171f6afe151761985fc02065bb4caefdacad86bea62bfa09f6259feb85423b8d465c5dccd6dc96ef199b777e
SSDEEP 6144:kdeM52XuoU2kwK7EPyK6fsHEOKXBskdRJSIcyFbUjAN4xCtkpMN2/M5N7NjIJhRM:kdeNbzGsz2pov
TLSH
T16F64081557F49E28F0FF0BFCC875001A4B75B8826416F34D6BE4A4AA2DA2F81CE547B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.Tracing.Library.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.Tracing.Library.dll
Size 11KB
SHA256 299af742395a73e25086a5311f3634746aa955c75baee90991fcc407bb573531
MD5 13ffcc12d6deed0f55eee9654c81e3e7
SHA1 a72c56f515af8c818cdee87ef49475b37578eb47
SHA512 c3c0f0db199527f926263a2cfb4f7d77ead703c4db785476b3da1836b36b1e2c18da2695287d2c38e531cff04f9d7e416f98ff2b5fa494882c2c19c1619cf1a8
SSDEEP 192:SkeCgmX7Pc/Zont5KhMrdHS4wxWlFWhqqO:S5MX7PyZM5RrdRwx8iqqO
TLSH
T1C132D548A3EC9B07F9BF2A76797212040374F972D932DB0E16D8414B1C27F886CA1FA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.WPFServiceHost.App.exe

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe
Size 2.0MB
SHA256 9f36c774c85a299d27e94c351e302452ed7e2007e5769908acb96f87b871f5db
MD5 b6238f379970f93e4da352f1ab462f16
SHA1 b5fdb86300d38da001317eeb7fd2cb04e9fa9c82
SHA512 19995b72fd4c6e52cf67c70632af80a4061d8a8a289b695dac7003d1c348e4946c698d8086429ce1f6cae89d00f5f8bdb1bddc8519d4f3e0d3da4bdcd6ffeec7
SSDEEP 24576:LiuUMh+W6bYEPy/TciyXUKlc9TLF6ZEeiBugssDhz0FOM3:WtMhY0cdZlcpLkeeAmsDRPS
TLSH
T1B3A58E78FD2406B9CFE5D93992A3CB082F2C0805A5BDD41135BF2C9C6BC97E6459878E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.WPFServiceHost.App.exe.config

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EPS.Devices.WPFServiceHost.App.exe.config
Size 1KB
SHA256 ca5030dcb978122fab1f0949be3e53e6f833e53dd55de3916f676191b5fe8168
MD5 ea18adf3f78a5265c001db9c6fa12a14
SHA1 56f81f9e366b101243cc53d8a46ac6c2cec10063
SHA512 9c269229b99b2d333a59200614168b7c81d215947094f00f3ec3c8f0251c052adccccce31179748b4db8548b805fbdf6dc9e43212b17261aef5e83d16210ee58
TLSH
T17A216D3195C8AF968F7119A33E776824CB6D03B7288C009DB0FE6E4B8F3599A5207173
MD5 SHA1 SHA512 TLSH

Submit Download

EpsonBankDriver.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\EpsonBankDriver.dll
Size 80KB
SHA256 2db5c76b5009158091f5112ee86b2e2b78f8cced5abd017c5e5446977b0d16e0
MD5 d56c4d0de27741e39537a0829abafe77
SHA1 0d9772329e95902c360a1625d80c1934ed50f9f6
SHA512 068612abe38ffbc66fa044874c36e6801fc79234d0ca3f50695c614ee9438fc303c51a4584cee459bd955f0c0c2a8a71b18471a01419663e297251556610694b
SSDEEP 768:68dnAidttDK9oRxJORFV4zbCSwvZk09kzNu1wTSWgYrRkffUWT7YjrqXJ86jIX0E:ddA8i9oApSUk09kzWnUwvJ8FX0ct
TLSH
T1E6831841BB428477EF9E1B76A0A107218BB9D14965DFE38A918C68FCBC973F055027CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hardcodet.Wpf.TaskbarNotification.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Hardcodet.Wpf.TaskbarNotification.dll
Size 46KB
SHA256 f1358717e2d2bb5af96fad6ce816f8c7624082dee2a161164aa8c4b99abbd440
MD5 97ead3983be7a86ab4d2757ea41379ca
SHA1 e86db6909de3e3887e893561f9bde4c25cbca67d
SHA512 5f1fc911cfc2c7f5b8fa0d5bded751fc809aa792710a68ace2812b3c16f6d1ce1c1d33330f44a8bc2f7b616b641a4f8a537c831ce970f5d3242aab6ba9fee4e9
SSDEEP 768:gx0J8krjBiXGWQ/xdoR+EzKMSyHZP9j6ZXq/fXjeceV:giJFiWWQ/xzEz3P9oqnzeceV
TLSH
T1A723299627FD896DC5BE2BB8786122104331FA537913FB288BC0A57815BB7D48B113DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InfragisticsWPF4.Documents.Excel.v11.2.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InfragisticsWPF4.Documents.Excel.v11.2.dll
Size 1.8MB
SHA256 47ea75b9f6c412f2af6104ad4714182155a0d9c065752f712255e61809100db3
MD5 68003631458c9db17d554df1875dabc8
SHA1 eda5265078a4cfaed1eb84f1e2ed6f5a21bab22e
SHA512 29d4a0a36e10eea234204f2b782e058a7f86d56bd7737c075c2efb548d9a36b49896054f8ff24cea0ca64d549c3ec13ee9383d04ae7445275fd9ae1d3179fb20
SSDEEP 24576:V1kdgOYVd6bw1MGLH6cyy3tKYzvcRDueJVvq13Ae:zODGLacDvsZJVvq3
TLSH
T1B185394477ED6F6EF4BF0738A474541A09F2F8966742D70F2820666E2863F608D26B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InfragisticsWPF4.Reporting.v11.2.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InfragisticsWPF4.Reporting.v11.2.dll
Size 191KB
SHA256 ca642633ce9fa4bee7c74dd9f69bad32e49f1cee695e5a6f53335cd919d43d2f
MD5 b43b7f4969277a3403732b09aa6f188c
SHA1 43b4184ea3459529da7b37833b9516b04abc5bc3
SHA512 009b2dfa53f4c9bea4fa45246de7b989fc894ce360c332d5eaee9a2920622705257af17a21a8fc5584f67653e29700893674dec0e63abab28a8a7fde7d8d2432
SSDEEP 1536:aQ42Gk3NDl7cMDn8bySx4hyOsuHPY/nHLmSYhRMuWMNBXmbQ2bJUlfUh53GbITCp:542Gk9lcipRF2JUlfOGbITUTPyA
TLSH
T1BE14E88423700D75DEAE42F618E01D280866B396BD96D25DF58823DF68FFDC04A35B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CanonSetup1.19.2017.1225.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\CanonSetup1.19.2017.1225.iss
Size 640B
SHA256 9efcf772e7e73c8f2222fff3c7d847d7a8193acd918e1c8a4ac8b175ac2e577a
MD5 a245a786710777d24c0f546299259b7e
SHA1 141443c0840d1827fcd86dd8cec5aed566877f5a
SHA512 5a6ccbdf7cc1d43d659fdeca31d9d8488e543c8403025cfb277262241215ea13d83387203a954a70e0b7a9d15ee982e1cd3e11674a0157daae815e16947c46ec
TLSH
T129F049C0F709FC543F4107C03FAACCBA5E9D8358DB9A84A97EC114946D03831849F699
MD5 SHA1 SHA512 TLSH

Submit Download

CanonSetup1.20.2024.1203.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\CanonSetup1.20.2024.1203.iss
Size 640B
SHA256 ea9d08d29db784e1aeea634a60eef479fd1c12208c744eefd3491a8a80f1da52
MD5 4107fc08e6b31d7bc798fa9cfcad5ae6
SHA1 3845c1fbee8af290f6112fc78abbc2d6e52df1e3
SHA512 4771b04d74bad0156533d27b0a431534e903acefc388064073924adaab5dd742a1add23bd11da814490c5d40f69109fea702d55cacc30094382ca710062c6c00
TLSH
T12AF049C0E709EC583F5107C03FAECCB65E9E8319DB9A80A97EC115945D03831849F699
MD5 SHA1 SHA512 TLSH

Submit Download

CanonSetup2.0.2018.712.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\CanonSetup2.0.2018.712.iss
Size 637B
SHA256 6c0b9a608b6f5fc6133a9bd7e98d5d39b7a4b87ea50cc7943c9557e1321a6b36
MD5 71346323a27078eefd13de2bcae0860a
SHA1 1b35dc6a2041b75891da783364b8b58dd76bf195
SHA512 145c37fa87777a4e66b9ebe4c2e7689a1dfa71628e59d2042728ee49546b693b1410c519f07f2239cfd039f93939357ee0d6cbe1c1e789cdc6173186af27c1ff
TLSH
T1EBF0F9C95005D63E36C639A1332F94DF68D521BF1BEE818FD6AF4801DE03C189848E8D
MD5 SHA1 SHA512 TLSH

Submit Download

CanonSetup2.1.2024.1202.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\CanonSetup2.1.2024.1202.iss
Size 638B
SHA256 f15f91445b624f08e96597e0f0c6a427d8db5bbf4f854fa000d840d782954363
MD5 e24db3d143a27aa327918da614373952
SHA1 6afadab129c011c715ac5f3cdf287bc408132751
SHA512 cbaade728dad47df8b73ac35dcda14b8ecd6186b82d823db68b4e2d3f338794dc859fd03c63581a1215602d7985bccdd98a69cd9d214d9a016239b194fbc284d
TLSH
T193F04EC85000D62E36C63991332F84CF64D121BF1BEE818FE6AE8801DE03C189808E8D
MD5 SHA1 SHA512 TLSH

Submit Download

CanonUninstall1.20.2024.1203.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\CanonUninstall1.20.2024.1203.iss
Size 425B
SHA256 17fa1c340462766d78d4bd33864b8099761dd7d151e84f1ade44453d852f8275
MD5 19f88f09f9a6c0c5e8e00a647a1568ac
SHA1 7e6dff11379a8670096b5db7a7c18ba77403cd3a
SHA512 e616a0bfa0107a8de2e1e4d89f472eb0f049bd4cba7671b603908bbf67df5a200c2527f2d3b5be9b3c82e65aaefc3f0b856ba768910773a50f7782043571cfa3
TLSH
T1F4E0A0C09B09EC943B0202C03FAAECB6895E4359DB96449A7FC514D9AD43471805F789
MD5 SHA1 SHA512 TLSH

Submit Download

CanonUninstall2.1.2024.1202.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\CanonUninstall2.1.2024.1202.iss
Size 425B
SHA256 797136e6cf87fb1949b09d5feff85be4842e57e20a82cec21527d4364881e5ba
MD5 cda665bb08caea1ad88974ad9d2fbe4b
SHA1 ad3cfd606d9d3b00cc802407b0c145594f6d0568
SHA512 ced5979de2d44ae7b908f4ff6caa654a0ac8aba9e391d6fe0b73120a8b509a3c1b1b9fe848955f264fcbc46a75906b33adcd225b92d590214f9dcc858f110109
TLSH
T145E0A0894001DA6E36C535D5372FA8EF948511AF2BEE418FD76E8842EE03C54980CF8D
MD5 SHA1 SHA512 TLSH

Submit Download

EpsonSetup1.07.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\EpsonSetup1.07.iss
Size 1KB
SHA256 aa8529ec72bb18bcd3154efb53c783b2442e3f1789bbd95d20309e4a68c661a5
MD5 1e1e412dc4cb8bf336bc18424c98bf71
SHA1 24817cbd862674334b6492f01d7da44fe001e3b7
SHA512 4a8172cce8a748d6b62628e1efd98de9bdcfd903ffe23f1ce7b9eb74979e3ae24976d2f67c2f272c2247fe77e4af7d2b5717988a089b9e10783fdec1956b1fdd
TLSH
T1BF115484D892CC752C04B387D261D1964DC493C19E76211FDEACB48D6F96FE399685F0
MD5 SHA1 SHA512 TLSH

Submit Download

IMAGE.INI

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\IMAGE.INI
Size 20KB
SHA256 26e81e5401dc7a1950ab5a7531cbf0a9c2c1452fea41c78aa31be728d74e21b3
MD5 ad5cd862b7b5de7c265ddc5bd2a12e15
SHA1 e82908214a648a1fa1203401f540ca41c9cfffb8
SHA512 8e97edca75bbad79ad9463a9ef4c5806cb6b2517c60b65337cad1affba943ab237ffdf1db6f8ed7affd6db534af3bd5ea0b51f1a09d7ed48a671e5bd1486e614
SSDEEP 384:CK4ju8iGFqsfP3S7EN6V1vaHAtAwSzCwSfwSmFORY/ORYt:wLtFqs3Sb4HAtAwSzCwSfwSmFORyORE
TLSH
T11F921D29AD89A3371A36C082AF1EB681D790465FB32EEA54719FC3181F30A55037E7D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MagtekSetup99510047.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\MagtekSetup99510047.iss
Size 475B
SHA256 9140556b45c1ac0922dcba00fd081d5d790ff649cdf79eaf3a96ec8d24422650
MD5 0ea0bd5879a864c3ee851a2f3a51d508
SHA1 d2a35edc55e8b94e974a0bb680cfd70f34551bb9
SHA512 8933ec80adafc4dacb5d95df3e9079c8c5b034053acb4dd4ce23df3e2dd62a791fe16435a4b592de6b81d4b991ada95d5eb02f652f9953a71264e64fc92151ba
TLSH
T11DF01265DE0D873D3586066F5514DC8C3F461B184D4A2365D94C7543DB8AD2B2B48FA3
MD5 SHA1 SHA512 TLSH

Submit Download

PaniniEverestSetup3.25.2.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\PaniniEverestSetup3.25.2.iss
Size 513B
SHA256 f037036df1dca226e031aadb2cd22df5714286616a8ce1f455ccbea1591d369f
MD5 967b7ebddbf23d8babe705d140688e7f
SHA1 9b8af19176ee7a936930178cfc0ff5019d9d2204
SHA512 c8b30da6b0c696c22afe1328c18975fb687c7c6df35ca2d89090b2f50ee15ead404352c2e978b8ccc6b4efe95d85801876a4d07400f3aa9b7b5b546c0224d7ab
TLSH
T17DF0E9A2C18240BCEECBED613AA1D8A42FF5D31C169C753D95E28548CF908D8B82544D
MD5 SHA1 SHA512 TLSH

Submit Download

PaniniEverestUninstall3.25.2.iss

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\PaniniEverestUninstall3.25.2.iss
Size 515B
SHA256 e316b71d4d245fa7f1cc46685d4b16b8dc2e13580721a69ae3c697dbc1302eec
MD5 7b51d9dd5769ba424c20fce5111a2cc5
SHA1 50dac4db23138497a8ff08c1b749b24f07736d11
SHA512 ab936bb06843410d4c17baefe5ab810971931106f4b1a31f29088d67df27b8ccaaa1c95cd37549cd7de0a16f814004891fbddd181c988858248ebaaf753f52bb
TLSH
T139F0E9E2C18640BDEA8BFDE02AA19CA41FE6D32C55EC663DC5E28548CFD04DCB82544D
MD5 SHA1 SHA512 TLSH

Submit Download

READER.INI

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\InstallerConfigs\READER.INI
Size 14KB
SHA256 6dc27ac69795d8881bf677f6ef8976c688ac984a5eb5fc7aea3b60f99cdd80f8
MD5 d57781337fb35cb09ec4472c0108d901
SHA1 ae13f5c97c4756fb17e8f1288096b1b5242b45d9
SHA512 f5446cce7cd7a252b5ee9038eb76cbb21f3832f4ba4309f5319bd662dfd87c17942f1e38486f151f981a08867643c06d4a323321f4886344fbeb6b76755c76b8
SSDEEP 192:LuVZMy8CXJao9Ov7eOAb3tNf6MDmvM+iutNf+MDmvM+putNf+MDmvM+y:M8CXgKOviOgSBd1mBd8mBdy
TLSH
T1E56296336A88733723498282B27D4682E26C07CEF32E69E9748DD14C17A9C6491779E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Interop.RANGERLib.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Interop.RANGERLib.dll
Size 32KB
SHA256 f95d01ec16c63a7f6139da7563f554e720e84b357236bfa488120b1545f21819
MD5 48c29a22b7388815e14fc1ce4c997f3b
SHA1 a910b629b88213b18f0ed6bbd17a10ef060b2ac1
SHA512 1fa20b43aae7724b89c2bc069b50db37da6dcec230d20e9879d62c7d26ba1a830805462a38579d8990a85b81310ff7539fcd997b80a9e8e961c1a6d8510389e6
SSDEEP 768:KrkSkxkAkHkOkNk8kjkak5kIkfk2k1kkkbkCkBkwwYRu5q3S6Aa5wouQ8X:ad2b8haPgFuT0pyHYNGrwhiSB4wtX
TLSH
T129E2C841324CA426D9ED037BCFF702205B3589157533DB03759D32AA3AA635BAA8737B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JackHenry.Eps.DeviceControl.Dto.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\JackHenry.Eps.DeviceControl.Dto.dll
Size 45KB
SHA256 24fb0a5f891c94a8352de8b0082b34476ea8bb3845bf1802aa994f28a7b4a84c
MD5 a7041aef872f8d67da8e93cf0835e159
SHA1 082db0d14ffd0b17b25073f6ba48a272ce531593
SHA512 f73068d24fe18390baf2ccef955d67b35b959965f6406e8462510b8f0c12609a94cf0619ac69bdd3178e202e2fdc0d2b19a1aab35824eda0a458c548e31e1b3a
SSDEEP 768:21EKoV1yrL6dRe6KqCTWi1GbqBX+volyXdtea4nj+oMeU6Lh04o5HFPxR:2GKovtKUi1Gb83lgzEyoMR6Lh04onxR
TLSH
T11023E81A637CD33ACFAF0ABCF52646374626D14A7613E7AD064CE8DA3912752C5880F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTDevice.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\MTDevice.dll
Size 69KB
SHA256 40a9725ee46794aa11523065b459c0fd86cb674b9039e1b608989ad4813a2d21
MD5 b5ea3761e43e9eea45ae7dea317b53fc
SHA1 293c8c32280b0665aeeccb1493875d22b70897f0
SHA512 67cd0df79acb648654c44b29d9dfdd8230bd0a32a30567baa59b053ec8cf20d4d20933b7a3676949f4e2b2eee23281caa737fcbff8e77b80d1aef3149a5d028c
SSDEEP 1536:kN+/tmF3O5PWKFQEAn2mDwgOtaQUod1xd9uOxXc083Dc6:kItmF3O5PWKFQEAnKd1xd9vxcbc6
TLSH
T12463280E3AB42E76D49CC7FD85E15D43CF6CA087B50ED61A8D8AABA524363C4AD1047B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTLib.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\MTLib.dll
Size 10KB
SHA256 b6f3f2e6aa964c09ef08e7bf1749daa7eb5f41359e74bdfef2155cd2aa30aa56
MD5 e2fbe81432117c7092df4ae8c56253df
SHA1 16ff94587b22844e8547d0c6e344dcc5852bfc2a
SHA512 25e0b10ce59002a5a77c0ca771545c11f86bbe0bdf9f46a0507ef75be55df6046ae452ad299b8486f3544ebd8bacf444bc72d8a88e881b39a8bbc20c5dbb54a8
SSDEEP 96:FKXhYx7PykozxgMUt+jup/9E9Dcjlgl2/LVpQaRkc9pQr7cJ+B/9cZ7oYh/Jingj:FM5kCxureNSlgleyaGcT84qc6Yh/f2i
TLSH
T13B22D636D3A8C13EDFB72276BC130F441B72A6445D5297994E38ED1D7D233CA9622AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTSCRANET.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\MTSCRANET.dll
Size 26KB
SHA256 cffa915c910b0f432f743bf60e71cd384bf459015afc3c45fee0cce1f14681e2
MD5 042ba2a53b19d9828cdd762e998c47ba
SHA1 2efeb6f094c2580f65946e69ad09b1e6a9095492
SHA512 7feb7166f44ab0b4ffcc76eb886b75bee89d139948db538a191fdf200f4aac35f433001c50ac3c701633e0c91752950c192c4a0fe9e2a82ea4cacbd0693557dc
SSDEEP 384:mT48HJvxZeAI6xv1/Mc9V5da3G3qqaSP3c7LU566yt8iujevpLKWIzRC9:mrHJvxZeLC/MGa3mZe8a7Ik
TLSH
T122C2D619A7EC5D37CE4E15F4D8A642018F78E65AB103FBC72E8CA0B52D533A10C6675B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MTServiceNET.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\MTServiceNET.dll
Size 99KB
SHA256 a0f8acb2d70e4c67bd7251f41beb7815c52afaf69b1583cfa9f21cf4e3b0cfa2
MD5 ad65a8572f8b84ec2b4cc24a55fb0944
SHA1 d55de29c14449c0732961037b30328b631263375
SHA512 573230e3109fba6b9082c0833ffc1c557bb096974d18c0a9fd9f7c912059b17ab0ffac9f68795e6055999ec2da8ccda8c0650cb781a6d8705a27b7a1d35aabae
SSDEEP 1536:oQbSpiE+uJVg/5BiKqrcQQ5rhz0h1p3tNKba45YjR2NdCaOPwo8J2V9uXG6a:jupiEUKcx5mfp9obafjRAdCaqkWR
TLSH
T120A38B3AFFDC0913D6AF53BDF5F0916187B4C2953107E79A2D8D69E8A893B9046003A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.AspNet.SignalR.Core.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.AspNet.SignalR.Core.dll
Size 345KB
SHA256 d962706c2101ee8fdbabad5f61edf351cca7a12c3768f29a0649fc0866f44ee4
MD5 da6ce845c69d12251fd1db35abda99b1
SHA1 dfbd66668481bd544292ab59cab4b717c3cc34db
SHA512 4f8e6377e9b81ce964d58564eb483356aa4554057136a836c70d7856beae1d99f936eda13b07ecb35505ebae5f32ac3b2c71b3cf914c8e0f324e2720c144aa30
SSDEEP 6144:0h0+XlaIRa+nxYVJWAD2ai3am2WJ6hn72Qj+J9v73:0u+XlTRHgQAbi4iQIp3
TLSH
T14B747C22A3BC4B16E7EF0B75B820241946B6E987745EE74D699CB8FE1D53391CB00363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Bcl.AsyncInterfaces.dll
Size 26KB
SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
MD5 ff34978b62d5e0be84a895d9c30f99ae
SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
TLSH
T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Owin.Cors.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Owin.Cors.dll
Size 18KB
SHA256 599acbc68834b1a0a4c3dc40896edc2f16bc12dad5141a5daa94db15a150bfb3
MD5 df0d820639d157e84b008690b64a438f
SHA1 bf83571357c1058f9621889bc2c37237b4ddeacf
SHA512 0220248d7440f38a72e66801ef5fe078591957cacf8760cc03a8e820fc27ab0d156e28ed7e7c012f50341e48712615598735c3fd68008563aa48b95d5d75cc91
SSDEEP 384:jxH0MFVrgkD0Yie48WjkfWI/vXS9//0GftpBjr9o:jlFFVDZ+8ig
TLSH
T164822B09CBBCC713DDD65D75AA518AD26F38DB52EC01DB271C89E1DE0C833544B2066B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Owin.Diagnostics.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Owin.Diagnostics.dll
Size 639KB
SHA256 1d459563f75f212fb1b8fce51ae9e48ff09bd09a69192cd7ab6c35d3d376d731
MD5 7918e3977b87cf40577bbceb96489c1e
SHA1 df374633916b8429c6ad161a872360755aad0e0c
SHA512 259215c6387b8c77880f66b6367f205a7fb436e878d6902822a1d8a7c9c69c61744e340bcb3ed1fa03ea69ebf6f7949adb4249a89d3858f8dc28ee3acb0e97dc
SSDEEP 6144:z42Ku2Ag9ln9A3abeYaeBzmKeNgQyancUBUTpbzZDLqfDKvUZZXt:U2KAg9l9A3abgyanFBUTpbtDIDSUnXt
TLSH
T15AD4F0106BFA5108F2F36F619FF5A16A493BFEA7693DD25D1008064E0733A44CDA6B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Owin.Host.HttpListener.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Owin.Host.HttpListener.dll
Size 102KB
SHA256 caeaa90daa2558b8a3c9456f80b33528b19ebf878afbdb0e184eb4e5655f23e4
MD5 082901c4ce407621e6512959552fca61
SHA1 eea11325207147122d134b498aa1de7ec5becfdf
SHA512 a860913c13baab35fa52d70ebdc4961680988d8d881e30f065a7425f7abcef4b363485ad25524261765eb0ea38b40c140f88e2f44b1bbe41b5782e054f3d724c
SSDEEP 3072:udUk3jMldH8YlqzVl2LqsNBIy7YMWGy8u:qMHH8YczVILxTIy7YME
TLSH
T1C5A34B1193EC8A27CEEF5BBDE06161940B71E3A1995AFB9E4D6870FD0C92340EA50377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Owin.Hosting.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Owin.Hosting.dll
Size 63KB
SHA256 c1943f3f7bdf96926cba8e8dde4039a114e1396dd5912eb5e5dedc49e9e7e26a
MD5 984cb47683a8e64aa26701f582c60083
SHA1 3312204c76c4e2ad6a96bde12e2335d2d7b67c76
SHA512 bd5cafa4c6d20a691e2c36d2acf55f5dbddbfa257b44c4efbf63d0055773f11edd7f478cca98110a0aca6dcf30f5614ae8cf8a882a788eabd455b6da03816a4a
SSDEEP 768:Dmmr9341QUc9fdgM3T+l92KKE/7Z0JOLouBSOAh2UOc43R1Ooe/qkCuxH6UPwiW2:Cmr934Y9WaTg92yTZ00BAh2kiOvJTW8r
TLSH
T1B9534A1473EC877BCBFE1B79A17565014579F7A72512DB0A0E84E0EB2827BC08F6066B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Owin.Security.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Owin.Security.dll
Size 48KB
SHA256 a06d6f4f578ec594e573dc721a8b57da9a355e1ea00ec5aed06a2d495c62d646
MD5 08af23ea848478f24e58281032eb75f9
SHA1 5801af7ec99602b8b7d9a85090c84f5f5cfd49f6
SHA512 e61dd19dae186ae5b2651cd1ef07016d522304bf1218fff4f39e3063c5cfeedf7f08ccbafcfb62e2a6e9f5b7e6a8befab478188fd54d7546d60b38dcae31ddfb
SSDEEP 768:J3MN6NRpuXgcbFGQzfaHXZZ5s1tfgiUnDCWn7hyT7uS4c8iGQ:dMgmgxQzfa3Fs1tfinDCe7he2c8o
TLSH
T1BA234C0193ECC727DBEF2B3DD6348281163AEA5E5901EB5A0E88E5DF0C537818A517B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Owin.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Microsoft.Owin.dll
Size 91KB
SHA256 c8da438e85d6199af959fef52418bd3ad185a079da3d55ebfc044d838cf69e5f
MD5 c5bb233e8c35764c65def2811f37c78d
SHA1 8d444dd561d13bdffaa240f0662ceb3ebc512728
SHA512 9cb846e2ea4c6b32d7aaf958b3a3dea05943ced8f45477c39057fa437bf2c9fecdc4ad13fe0fe67ebf22fd50fd355760841a66173a4a57d6704476af7ba11872
SSDEEP 1536:WzktGUX6Fst9VD9VuisKD+95lXJ5v7JPl0K0IM5J7wQZAkB9rI8H:WzktGUSU/VuoD+FHv7JPl0BIMT7wQZ7l
TLSH
T1FE933B16A7EC877AD7EE4B75F030411A4B79F5977C02EB4F598868EE08537C08A30A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Newtonsoft.Json.dll
Size 490KB
SHA256 0edfac6be11732ddd99db66821ee47408c2dc1e9bed68e5ef9a8e130c565b79b
MD5 cbd6029abaa8e977d3b7435c6f70dd0e
SHA1 ebb89d4d7659ef77b658a86ad00dba0ead869f4c
SHA512 96754c8a846311ca59f8ec38185c2a204017bc8bc73bae1fdee63b66f3cc459017ed34ca164b53d625abfae683683b278e1aaa66346023018411ae70fe9e8059
SSDEEP 6144:EUjGZDUI+aj1pJcggovoff4dCWycRrMikC7qEACBdr0tqngai0p7eofLPsT:xz8Dbvon4dnkKd7Q0nyofLP
TLSH
T176B4394533EC8727D6FEA735A430151187F6F416A3BAEB8F59429AEA0D977804E20373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Owin.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Owin.dll
Size 4KB
SHA256 7fedc19bf6c18a0f9629e90040d38dafd69b62ef46baadb3a079071a53ef5619
MD5 2f784aab0af82c96e1e978b46094932d
SHA1 a064258c415e3451e39725d4d970ec903b8dbc8a
SHA512 81a76ad96ac5c8ddce6b3671368de7c55d00b5c3960bafe8e8369fb9685f2b021a3a5db4da5c70c6bba4dbf424de32d4a5cfcd7a78d5f06f822a7edc9cf3d609
SSDEEP 48:69UJEqk2UFxI4b+EflUuJCoNKithQ40pNfaMUNZ43GAOF:880IfEf4aKUQ7aMU6GA
TLSH
T113919521B7D48337ECB78B76EDB3575227F4FE5099634BAE1950011A5C136388A72B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdmSci.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\RdmSci.dll
Size 77KB
SHA256 d03d8d49e37e7cb1ce076edbf0ba78cf8e5be81cc581c315046010ef204f092a
MD5 c7f5d95f2d9267b799ef9c16f190727b
SHA1 54de6449d21417513ef05c1be742405051b80791
SHA512 f9db13fb228dbe891dae44aa5c4c3e2c5e6a9592ab7afdbcd5f6094241d73fa6ada00f549c02d7b2c228e0ee66fa4fe1a8ff5c7a868336f85abba7ba4b171efa
SSDEEP 1536:HVsn3++3ZgBKGaAgUY0lVA8BFpFzjMC7IiLnN41ae3rhmP0l:1aCJkEVA8PzoC7IiLnTebQP0l
TLSH
T1A0733B4877EC872AEAFE1F78A4B415014F7AF982A473E35D1704A06E7D73B908960727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdmSciXml.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\RdmSciXml.dll
Size 48KB
SHA256 9e27ea394cac3e9c529d14095dcc4976a0d14ddc571093fd3a742c9c01953269
MD5 bc42926c9bce16003110196ad5a86837
SHA1 ac1cb86f352ebcc4bb40f9c1badcc299218921b3
SHA512 d2ddf4b35ba96b13efd595a9bfad6063f5f5eae3a3d75d5f97d49df0df2598fd05076390b3fa8cb7d07c9d0ab6984f4b3f465bf3ae7c217f924f196e6d7db489
SSDEEP 768:Ft9w01+h/msxrs1yEuvkcKRadHRleBoPy0nwYwkPQefHuF54WKfBzaKIbGlqR6:F/wfIy92ouBoq0wYpvtwbG7
TLSH
T10623522A437CC76DCB060AB5F430863D0596D1B93260DAF1CB68F8CF7A56BA370159E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Refit.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Refit.dll
Size 144KB
SHA256 289f6fd04abe68a98710ab16c9c567a62b77585a4f6dea03924b67e2275a182e
MD5 8f4abce4ef5d5e5b963aa96431f55dd5
SHA1 9987982626bbf2c260780a42897220ed7fb79225
SHA512 ac373bc890d4554e5a7d4280aa00bd63d580c2bbeb50b570c778e6395c94c6a7c572d10b01c7581b0ec4f55d1c97ffd2d3737963eebb78710f3627cb2ca80ee3
SSDEEP 3072:L1/acWuG8maoqr0vQhP8t6WD/PQcGyZ4RsMp+:L1yNCJoqBuHh4RC
TLSH
T1C3E39E25A3BC4717CFAF5974F07481661B35A702F822EBBA5E98B1DC0C93782B950367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSMgr.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\SSMgr.dll
Size 2.9MB
SHA256 9725d147043ce10fb27c6f2eaebce4a4053aeed28bf9ce895cb2c2941cbd500b
MD5 c5b953ddedd65b06d776d36ad6a80b28
SHA1 22fa82b6d85df8b3259112ac6c0a49855f4583f5
SHA512 e7ccf3991ef4096fcb70ebfbeac3c339ae16d39e8767bd8abf2a86e93460c702a901a1cff9616c8ba00993bfb1b59cbf137905dde2df58ea578e308cc53296ce
SSDEEP 49152:pXqlDYBq02Qv0yT1raBQxEw0JMk1wHLP7hWusuHBiqNmZctGWna:pXYbQv0W1Vx0zyDfswJsctGW
TLSH
T14DE5E103F68A80B3D44D2134007AB73B4E3E665D53348AD7B7D8BEB5A5602E1A97634F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanCRNet.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\ScanCRNet.dll
Size 58KB
SHA256 897ee92819a393c96de92a00266786cb315fdee8c14401ab4d69c2e172b949fb
MD5 8e486d279cfc14841a14da876d960bd5
SHA1 877914f27fe3dc43868c8618ce7dcb685747a9a0
SHA512 91915d9bb786f6f8835df5a846bbfc221fe9d6e57fdb29018ea52549ce11ffcd7917d615fbc1552e553de2642cf53638da3de48e9c10758591d27bd24126552a
SSDEEP 1536:kB9LXKOoazm4M8tNwHcpXxCDsw6GrY9OI:kTXKOxzm4M8dXxCDsw6Am
TLSH
T142436C4EE7A0553ADD7C0A78A4B3076003B4CA48380B97AD25E6EC3DBDF33B92D45695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Annotations.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.ComponentModel.Annotations.dll
Size 42KB
SHA256 04113c8549185519f3202790ceb23df609644872b9c249a56d2bcf59566102c4
MD5 7d3d14b0417a68ccdd9c51972ff74863
SHA1 ceacbd53b6a02e1f7337a6b0058924e1e11949bb
SHA512 b2d133214f21d700e1af0c248dcc11ef66ea6da62043ff6d5e900fe2a1665d75583e4cd218526a146f2c62e22adf4ca2fa3b8879ae0f5a2e515e2c3a5184ce9c
SSDEEP 384:GnXppnvYs47bNql0kevR9SDQxSWIfYYL8oRT3KI3lUlBmeEZeTfyDxdQocwc1fVZ:gXDQsPurQcR3y6JOnSHDYFD9VioLQJ
TLSH
T10313D842A7F81139FDF34BB06B38ED96597BBED66D22C12D149890CD08B17D08B6173A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.Json.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Net.Http.Json.dll
Size 71KB
SHA256 6dccfc0f0d57110644b6b300e11fbf8bbd29416cc5370cf4c389aefb7539e768
MD5 809423519f282e7b4d6844a902a9427f
SHA1 c41c45aef934b8723a346b00509ffdd029835393
SHA512 4b3477fb74f82ba9d7812c334579b8ba78ecaa9e03f2dbe56c35cdf97a52d55ffb64ae5e05c2907643ecb2df4f65fb51fb3c131df813811f89668f446f69f701
SSDEEP 1536:yNLOOOU45ST4k5UVVEoibB3VYvbS9jlX9BQWWm3zLzx/:K8sqERYvbS9jlXQWB3jx/
TLSH
T176637D0867EC8717DA9FAABDA934EB160735D79A4A13FB4F258C91E814C33444B503FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Numerics.Vectors.dll
Size 113KB
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Text.Encodings.Web.dll
Size 77KB
SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
MD5 fa9d0d182c63c49a4c567f7c1652b6e6
SHA1 55ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc
SHA512 58f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7
SSDEEP 1536:AOOgOOOc2yQDmBkKQh39thfavqcdUIUdu4OzfocSWnO73TT+zo:KyEmXQh39HfavqEUTjOzfo5WnMO0
TLSH
T198735E12A748C75AC75E153256A085619BF0DF6F2313F782585CB81E2B733C9EA0E2A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Text.Json.dll
Size 629KB
SHA256 86c3f263ae9b4469ab1266c80471087082447eb4a38e6b97bf5e84de15c07a1d
MD5 d7e1e8629da31f3482045f243edd50be
SHA1 d3ad7f529c0b9232206348842e31566ad7347135
SHA512 0ebfcae7cf17ca0c4299f6d1cd850f0f8959b49e6bbc05079fa6679838abff9eca3a09ad8158f7b0395dabb20a0b9a25efe1d8f645ca9ef69bedce45606a23d3
SSDEEP 6144:oQ4zRvmmBhTxZOnAHqBfFgICCSToJkR4mUfimb7MVM8iHtoqurICVLeV+kctqWan:BmhZBAXM3eVcTQKiyfVtQ1RCHe
TLSH
T1E4D43A0467E49F3BEADF5370B07941249BB5F81A6329E78B520844E93C937D29D837A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Threading.Tasks.Extensions.dll
Size 25KB
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ValueTuple.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.ValueTuple.dll
Size 24KB
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
TLSH
T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Web.Cors.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\System.Web.Cors.dll
Size 25KB
SHA256 522f9fcb7748d8ee8fe4005b405b49e86271ca894261ce15bd3e68c1b44f61f6
MD5 5fa452ab11ad6a2d15848c16f2c9437c
SHA1 193e088ac12f32938ee42a930c453c33e5191269
SHA512 74e535329f931d5b77dde272c19e87ddd645320ea7db630f6f84e0d31b7b5d7f7adb9662a37321b79d74b352435c3af19d374e8ce6ec5471eef2f0dad312ef0c
SSDEEP 384:wrNhs00FhWloR7vG2qJhqD7AYPsFsIizSzW7sWz1q//0GftpBj2D:M/c0Qb9xRK8i8
TLSH
T1FEC24B11A7F48265DE6E4E34FA31C968047BFB46AD13EB2D5C9034DB1CA3784CA20F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ts2Dll.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Ts2Dll.dll
Size 3.2MB
SHA256 b95e2d753f1fe1506c1e29fc8b3b3a62f37543179de92f2b5d6eef1d0ea1024d
MD5 50dccdf9d43131299659b6381c25301e
SHA1 28f6e5932363f7a891ed77e1700de0543b2ed964
SHA512 d7bc3a626bf97b5151b4a976b38fb843413a14542da516b9f3ded82aa1086d11f021721edfc5dae320f497c7ba0123bdb478fb32cc40e57b9b7f44a3a3f45871
SSDEEP 98304:8h7k6sOwlFeKLGGF4fiK2LMp4JnxbEwg/BUF8HLVGVeQ5v1z1hRUxiB0B:AuOwz4pbBdrVoeQJUxiB0B
TLSH
T104F58C227B91803AC26F3631C51EF379A7AE9A708B3952C795501E3D3E744C39A3865F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ts5Dll.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\Ts5Dll.dll
Size 410KB
SHA256 ee9c13b351833e2b78d80981dae06af3e85561810a0ae98c9a5778905968dfbc
MD5 9ef8220bda19bc27e2e292526a2e38d6
SHA1 e82e2541a8b690c944b0dff77d6154c5f5f253a9
SHA512 0353c8f1ff771f702ad56ea30629136f2a1fe75764352c8c18872f4a4345da1157625d66af9f072788a481475f2ec73623eb0f623a5d7cf2f961c7436c10ee5a
SSDEEP 6144:emfZDjVdFUMyuGr5vGHECyYBGSv+O3fk6xxXWBZ/ciMZ++JBp9TAOM9H:RfVd7Gr9+VWO3frXYZ/vMA+JBp9To
TLSH
T19D948D23F502E121F86701796D7CAF6E547C62316B7B24E7E7810D6A9D683E23E3124B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TsEDll.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\TsEDll.dll
Size 503KB
SHA256 001bfc3286301c0982764d59376252b26342c0a27f55516b4a79ed035e14ca1f
MD5 468c779fee6c7a389d145f4d5406a29a
SHA1 183799102a7768d8db92525118b24890dcf2fb5c
SHA512 05aefe76157b425af4da968be1155266a78dd53da83614efb45afc8d18575a2370cb2652aa73646db0be60632f4f89351a2d21c0acf693bdb77f0f553113b1ec
SSDEEP 12288:AWgi0h5+enP1RncKVmrBLcrqRcZrUIp/QGz/L1iQz9ckR:AdZr59is1
TLSH
T17AB49D20E200C172F46651B1A67D9B755838793077B921C3F3DC6E7AAFB42E26B3464B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

buicap32.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\buicap32.dll
Size 1.4MB
SHA256 933f5cdd64732eaa4d2f18e0977b63abae5a8445bde09e53d5ababf2a27fb142
MD5 311355aaac0b64e500e68377c6d488bb
SHA1 43a4c86b549647c87f3b625b5a19acbc3300f37d
SHA512 90fd44eecb715521e40642ec4d5883fa8d56298b57c5623ba6e135ae34bd86d5097181bafb13a568d07d24fc215b8ba48f606d524bc11891a40d120f9fbf200b
SSDEEP 24576:Cop4vkfOEePj+TdGZv4OPJg52n3N+gY2FOC3AynsUz2JJJz65GlB/mJjl3sB/HRd:zLfOE4+Tdgv4OPJg52n3N+gY2FOC3Anz
TLSH
T172658D22E782C126F4D220B0515687BAEE387B725C11605BF3D8BF5BE6742D2D91272F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdapi1200.dll

Path C:\Users\Admin\AppData\Local\ProfitStars\Devices\Install\wdapi1200.dll
Size 148KB
SHA256 97baac678e26a95a6ab541c9622b7a9230d1aa5a0007d44964f182a186058e01
MD5 9b84913aa2666deeda059bd8c025c82a
SHA1 0b3e9b911f9493ab505cdc492141cdfe40b34b7b
SHA512 5b4023863fe487c13f1ef1fcd5d83bd711cf95286cde587cd8fb12ed8515e62b5487f6046516bc17cb632bbf3699804ffa5ece44f76f1d728f8d9f82af15a766
SSDEEP 1536:VQqcEFFC0WXVQVwDaN8/0Te679PgeX0M2JM7wjcgmtIlx56NGIK8KtvTRCcbogfw:KqJK0WXi8/0X4a7RSlYI8Ktzb/ft8LS
TLSH
T100E37D12B701C0B2E0DAA47E1475C33757BB6130D3AD86C377540E66DEA52E2EABB346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS_Device_Control_20260811191510_000_EpsDeviceControlMsi.log

Path C:\Users\Admin\AppData\Local\Temp\EPS_Device_Control_20260811191510_000_EpsDeviceControlMsi.log
Size 2KB
SHA256 127ea9ddcafb4d985d7246ffb96fc306bf4123dfca4f9904385f55cdeb6c4e17
MD5 7698459c25065867255c6e23c087a4cf
SHA1 665d851448ee3ee9e453c1a2350ad9278149384a
SHA512 15c4d64c81db9c6e2683c438aa2108d0c18f4ae4b25354ca113a22114e209159b82c41262fe10823db4fe7bd8d3466f816946d9cddff782e768aa55737dbb767
TLSH
T16541E4141AE40905F2B65747AAF3C4529A33BC966835DB0C224A831A07B7D095C7CB6E
MD5 SHA1 SHA512 TLSH

Submit Download

TmpC3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC3B.tmp
Size 2KB
SHA256 92c5577ff569b8f1bf0a23a40ebbe88d165b47d2e129c741879484518e494013
MD5 bfac44b5766184ce541cc79afa520ba6
SHA1 786b1ced5b3c85f2aba79f52dcd43fd6933f31cb
SHA512 f13a4893bdb79f10803440712bb28e1e36c0d030439c7fac3faf7be09d21c14ab578a97280a64e31f8a9fb2caf32d68ca31f253bb74eed377479b70290b361b6
TLSH
T1DC515C1B497B8850F6F745D5E2F8090E59318F891FD424179D369A8A0B3BA57CC5C50A
MD5 SHA1 SHA512 TLSH

Submit Download

EPS Device Control.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Jack Henry & Associates\EPS Device Control.lnk
Size 2KB
SHA256 08eb30bd35c01ef91b0ee76811512f68055e6b4102f359447face3ec092f17f2
MD5 98ba996c2f9b0aae2272340436631a47
SHA1 8bc8cd0d15177630d0ee511731f5494e1fe7a6e4
SHA512 2dbe62a52fc3a0df55f453db98849b56f9176f87cb06a289ad07aa202110ed4a6fe4f0a931b0366bc295453f03b9c4fed3c010f7976ab0aba047f1704a577a05
TLSH
T16A5122001BEE2B26E3F65D796BFB2522E9353C51EB858F1E105181880962E41DC71F2F
MD5 SHA1 SHA512 TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI6703.tmp-\CustomAction.config
Size 1KB
SHA256 33d947c04a10e3aff3dca3b779393fa56ce5f02251c8cbae5076a125fdea081f
MD5 01c01d040563a55e0fd31cc8daa5f155
SHA1 3c1c229703198f9772d7721357f1b90281917842
SHA512 9c3f0cc17868479575090e1949e31a688b8c1cdfa56ac4a08cbe661466bb40ecfc94ea512dc4b64d5ff14a563f96f1e71c03b6eeacc42992455bd4f1c91f17d5
TLSH
T11031568E0B05B77711312753AEED90C5DB7561A73C95811834DE99293F36978137338E
MD5 SHA1 SHA512 TLSH

Submit Download

MSIDE26.tmp

Path C:\Windows\Installer\MSIDE26.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE5AA.tmp

Path C:\Windows\Installer\MSIE5AA.tmp
Size 247KB
SHA256 652d9eed7aa8a3b4e76143bfd632f3938ab6876c79e58c5625279390f81a60c8
MD5 690b974082657b95aaec94c02becb2a8
SHA1 ec395c7a9627a64e8f74785882ac648012a4345a
SHA512 d2a56e9ec17ea07eea65ae1644beeedb0d45513d2ca9b2542a587086e9891f0302228bd171ff7156f286140ce30a9581a39355f7b7f09b7cc14141d201f9cda7
SSDEEP 6144:RArbtraBqLlAG7rvVjP1U2CSt+26hiRzwbSDCI:GnBaimupL0St+b4JISWI
TLSH
T16244AE1076D48071F2BF2F381934A6A55ABEBDA05F71CA8F6748492A4EB46C0D724F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.Wix.CustomActions.dll

Path C:\Windows\Installer\MSIE5AA.tmp-\EPS.Devices.Wix.CustomActions.dll
Size 13KB
SHA256 23c49c05e363993c31018dc61a26ed19f7ca4d6d4172dbf3f20977832b4433eb
MD5 79405a150bdf6ca2769d55fa507d8e8b
SHA1 a5625b411ebbbf5ed84a41f89a323f92c9d54463
SHA512 cf2a350c6b83579b170cdfd1c2afd459a775619c56c312b6b4f0922038416fecd56e753e286976fb1ccf1365231ac15a749f55694ec070e423098c1c4ab451dc
SSDEEP 192:J6TEGRMgeWxkuRuuKs10lsQKpdWbrCjYv+MTa+0fU3n2RC1FWOba23ClW47+:J6TE8tkoqKpdurhv8O223r
TLSH
T17F525000ABF44629F6FB2F70AFB282914A72FD528935C75E1958914F4933A44CAB1773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIE5AA.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 179KB
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
SSDEEP 3072:BGfZS7hUuK3PcbFeRRLxyR69UgoCaf8+aCnfKlRUjW01KymkO:9zMRLkR6joxfRPW
TLSH
T159046B2953FC473ACAFF4778E261425197B1F2E67117DB0EEC8181AA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe

Path C:\Windows\Temp\{16851E20-BD01-49AA-BBB8-93D55C309E72}\.cr\ProfitStarsDeviceControlLauncher_5.10.9475.26330.exe
Size 2.6MB
SHA256 5a718d5a7624678c2af598276aa085c0efc3a3cf48641364cfa89b49537bf879
MD5 3cac44e60fe8eb628938848ad2f83c51
SHA1 32785542771d325b7f893be37f6b1868d7b736b1
SHA512 fc0af321e81f8dcf8631cf9c484dac3af7a1a9d2838d0c99fdd9e1a041ff5cb24af26c9f6a7ab32e16525326b3d96771e44ea739d05a89f65c80732d468f36d9
SSDEEP 49152:OT2pZ1zujTJB4412+LdGf8jE9zBcnmNC0JylEzrIRxhnEKad/+biv:OT0qndGf8juzdrylkg+dv
TLSH
T16FC51232A4614032E7F50573B92896303E6CE3282751C9BAD7C4ED0E7EA84D56BFB257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperCore.config

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\BootstrapperCore.config
Size 714B
SHA256 c3f87e7443addd7c4f79cfca9ba7fd1e1a919091fb8bc65dc7569ead772d8832
MD5 abed9f9a5195aced5c834c641c882a64
SHA1 92122cedcae7417e18093c35a3f71b8f6d1cd27e
SHA512 3f7dada481f5650e650429f19cd4a45af1a025087378641f824f352fcee8bab86c9a3e23a39da81348fa8f14df8c88e8d6e760a1594604f6cef8e99ba789ee59
TLSH
T10A01D40553A4F966DA32052FBA474660DFF4A2F29090484872AF675B1F7208F6B5335A
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperCore.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\BootstrapperCore.dll
Size 87KB
SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
MD5 b0d10a2a622a322788780e7a3cbb85f3
SHA1 04d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA512 62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f
SSDEEP 768:9BgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ1ErEgtCmYjhm:HHMBp/GRbgi5ofpiG2pq+51EogsmYI
TLSH
T17193182B079CA576D75E0BBDF4400D2793B0FA0C25A2E3EBA549D63B2CA371E09415F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.Tracing.Library.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\EPS.Devices.Tracing.Library.dll
Size 10KB
SHA256 34e593988f28baee22b57cd84579bf57c58cc8ab4ce13a12ba6a2922758460c4
MD5 d4943632ed13d18e98eaaf143b550132
SHA1 cb027b32acd3abd1bde2b2e8d5424ec3b1323c0c
SHA512 485ac08115c620bf8b0dfc628c01173f9cf084f2a724908660fef6b381a6d1c9394ce6b0d8c8a5ebb0f750e8ac091065f2c92bf43696cbf0b786aa782f3f3376
SSDEEP 192:9KiZVrXkesteaCUaY75KhMrdHkiP+tipRFo2qqO:9K0ZkestefU5Rrd5P+tivfqqO
TLSH
T1A522E704B7EC9726F5FF6B36797382010171BA26D872D74E1698818E5C23F542AA1FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EPS.Devices.Wix.WpfBootstrapper.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\EPS.Devices.Wix.WpfBootstrapper.dll
Size 293KB
SHA256 f576c52de1f5b63b678c5363b0c7c57e38f461d9a9d590d4f71ba80ab4370a9f
MD5 2ce8052ec8d5ec792b362817598a7b42
SHA1 ae9c5c37c0d3f53fd27072f904e589a7dc3ef643
SHA512 9d252ae750510c7e7fc435b3750d7d1179cbe4f0d9a31864858665ddbbad21661fd68a7cad29583fa21cfc7d2c775e160cd5cde303ae0a9a1f22eb5fc0ef3fbb
SSDEEP 3072:xFq6rATJxxqIZRoT82GGnWEMp7W9KA0pJaWZbJjaym15xJZJi:xFq6EPZRIXGGnHScn0poWZbJeym15xb
TLSH
T1D1541A5157B809BED5361EFA88B2EA4D2F34101101D1D82435DF2E9D6CCE684C6B6AFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InfragisticsWPF4.DataPresenter.v11.2.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\InfragisticsWPF4.DataPresenter.v11.2.dll
Size 2.8MB
SHA256 6f7b6acd230ff2a6a359a7b931074888cb7183b259ec5b2b291fafba082b9745
MD5 e46ea79549c151fa860f40ac71c8f94d
SHA1 9fb37cfab5407e1ec4ec4189026219d226656da7
SHA512 6bb43e5cf50ff75903756508562ef6259f3622d240513ea63cba4b133df7f95726c0c787e46e7ea91427e2da544e5d90494b122a07f417227d10068e1027faff
SSDEEP 49152:N+8XJXO+02yTiOyihgynJ8bO2hEQRaOkRsXOYKNu3KkttPhaQrppA1a8vNPziQnw:laOFsiw
TLSH
T142D56C1933F81A37C16F43F298F0594C82B2F05493C1CA96725D696E7FC370539A6AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InfragisticsWPF4.Editors.v11.2.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\InfragisticsWPF4.Editors.v11.2.dll
Size 689KB
SHA256 f1af70c5c5055e77709629a260e2119aeb45a12158f9faa7db7dc64fac46fdb6
MD5 80488ae9cb631e8cc4cf66711f7ce012
SHA1 cf34729583d9516566b818b1d24e2030dcce009e
SHA512 d2a7a364d46b10151879d0c8dc9ebe5f8e005b8abbaa351fe3f64cef32ede38cb57ea0d684b54aa5fd99b2ed68bc74068008a5198c2ddba9ece7ab0050b32416
SSDEEP 12288:IynNccDTlDUbcCwV0Zo0p/XW4AuGp3h5V6Jk5yKA5c:aGTFnCW4AnpRbyKa
TLSH
T1DBE45DB577BC452BDBAF86F04CB048444173E119BFC2CE1601956A5DBCA73920B26AFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InfragisticsWPF4.v11.2.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\InfragisticsWPF4.v11.2.dll
Size 1.5MB
SHA256 8dac7c794df92e829c1a7f9cfbf67bbe1e55b7d754c6e29533fa08a703029032
MD5 80f9289bfea823ca80046ad4a848d1c4
SHA1 d0e3a905b0771f275b21f0b8292113499894ba34
SHA512 fedf9a3dd046033d9edf87844cb46da643be09b57ebb102cc3c3dfc465cb0444f444072d70fdbfe3f6992313ce67a0d9751d417de2b6cacc8c6f61b2b0c03e05
SSDEEP 24576:7XPX7ScH2qxpNIHYAYivI1LH5tdjOXtzhwIY5rF4GCmn6Hnpks:7flrpNIHYAYivI1dXI44GCmn6Hnpk
TLSH
T14F756C05B3FC0B33C6BF52F5A0F9594C7632B09A63C19A252145AB6DFCEB31205296B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JHAWPFCtls_2012.9.0.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\JHAWPFCtls_2012.9.0.dll
Size 736KB
SHA256 0193eb2026e64d43c7106c24b587272e0880047d19a5d421dbef69c7dbfa5173
MD5 8f6cd3d7851ed0189e2863a0d0ad9b4d
SHA1 d3b50506e3778fe30ee74cfd742d764ee69c5108
SHA512 565ed98237759ecb6b5ba1e310a66ebbcf37191b0af5fafa9f65995035f8db20bf34725722aa4622948d0d77b4ed57dbb690b7d2f994fa181f289da68a1d6773
SSDEEP 6144:ccsxR/c+joRy1yyHdV3HkgMJLLTRABq5Y+4EVIgu3AybRGm00wpppqTTs9iVVOL2:cca/IC3kgMJLLTe/R0BiLEZGHBnfa/4
TLSH
T13AF45B9633F8983BC3FF1FB1A0681D446A34990765C0D61D39E91EAE1EE7B4290D22D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbahost.dll

Path C:\Windows\Temp\{55353874-D1E8-4523-AE1A-9AA59FD838FD}\.ba\mbahost.dll
Size 119KB
SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
MD5 c59832217903ce88793a6c40888e3cae
SHA1 6d9facabf41dcf53281897764d467696780623b8
SHA512 1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9
SSDEEP 3072:iyjfrCvv4JR5zsemsABCF0TPSLNegl/+b:xrrCYRsehsIX/E
TLSH
T123C38D12B98184B2E5FE1D3C497496614B7E7920ED74CDAB2384222A5FB01D1AF78F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3172-346-0x0000000000770000-0x00000000011E2000-memory.dmp

Download

memory/3636-71-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/3636-97-0x000000000BB40000-0x000000000BB48000-memory.dmp

Download

memory/3636-49-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/3636-54-0x0000000004800000-0x0000000004818000-memory.dmp

Download

memory/3636-55-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/3636-62-0x0000000006E70000-0x0000000006EC0000-memory.dmp

Download

memory/3636-66-0x0000000006FD0000-0x0000000006FDA000-memory.dmp

Download

memory/3636-69-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/3636-70-0x0000000007300000-0x0000000007392000-memory.dmp

Download

memory/3636-79-0x0000000007C90000-0x0000000007D42000-memory.dmp

Download

memory/3636-75-0x0000000007BD0000-0x0000000007C8C000-memory.dmp

Download

memory/3636-85-0x000000000B780000-0x000000000B910000-memory.dmp

Download

memory/3636-91-0x000000000BBE0000-0x000000000BEA6000-memory.dmp

Download

memory/3636-95-0x000000000B770000-0x000000000B77E000-memory.dmp

Download

memory/3636-96-0x000000000BA00000-0x000000000BA08000-memory.dmp

Download

memory/3636-94-0x000000000BA10000-0x000000000BA48000-memory.dmp

Download

memory/3636-114-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/3636-99-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/3636-98-0x0000000006B60000-0x0000000006B70000-memory.dmp

Download

memory/4744-589-0x000000000BEF0000-0x000000000BEF8000-memory.dmp

Download

memory/4744-289-0x0000000005610000-0x000000000561A000-memory.dmp

Download

memory/4744-594-0x000000000C620000-0x000000000C634000-memory.dmp

Download

memory/4744-591-0x000000000C500000-0x000000000C518000-memory.dmp

Download

memory/4744-596-0x000000000C5F0000-0x000000000C5F8000-memory.dmp

Download

memory/4744-588-0x000000000BF40000-0x000000000BF76000-memory.dmp

Download

memory/4744-593-0x000000000C600000-0x000000000C614000-memory.dmp

Download

memory/4744-597-0x000000000C680000-0x000000000C69E000-memory.dmp

Download

memory/4744-284-0x0000000005630000-0x0000000005656000-memory.dmp

Download

memory/4744-599-0x000000000C780000-0x000000000C824000-memory.dmp

Download

memory/4744-280-0x0000000000D60000-0x0000000000F60000-memory.dmp

Download

memory/4744-603-0x000000000C8B0000-0x000000000C900000-memory.dmp

Download

memory/4744-592-0x000000000CB50000-0x000000000D0F4000-memory.dmp

Download

memory/4744-595-0x000000000C640000-0x000000000C65C000-memory.dmp

Download

memory/4744-296-0x0000000005BC0000-0x0000000005C44000-memory.dmp

Download

memory/4744-598-0x000000000C6C0000-0x000000000C6CA000-memory.dmp

Download

memory/4744-304-0x0000000005CC0000-0x0000000005CD2000-memory.dmp

Download

memory/4744-600-0x000000000C830000-0x000000000C8B0000-memory.dmp

Download

memory/4744-590-0x000000000C540000-0x000000000C598000-memory.dmp

Download

memory/4744-601-0x000000000C710000-0x000000000C71A000-memory.dmp

Download

memory/4744-586-0x000000000C020000-0x000000000C072000-memory.dmp

Download

memory/4744-602-0x000000000C720000-0x000000000C730000-memory.dmp

Download

memory/4744-587-0x000000000C180000-0x000000000C4D4000-memory.dmp

Download

memory/4952-272-0x00000000029A0000-0x00000000029AA000-memory.dmp

Download

memory/4952-268-0x0000000002960000-0x000000000298E000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads