Analysis

  • max time kernel
    149s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2023, 23:14

General

  • Target

    LocalServiceComponents.exe

  • Size

    16.6MB

  • MD5

    bbf1f277263c9313e711a19ac46f8813

  • SHA1

    ddb9e6174d7d94fd43c11ada9fe917e5d2d7fb01

  • SHA256

    39a5e1c7defed7a5a43ffd82207d6915c2212fadf76e0184a945bf69ffbe6e06

  • SHA512

    6a80b34b41f32798d942e6f0b43b6b2151b332646a4dc53535709ca6a6f220b73cb339b20c5097c9244d4aaf20f603b1a45cd82ad40ec25f84e753ab7048d582

  • SSDEEP

    393216:zdbZ1/s91c0g7D6VX0FBXj1TNim0Ex9RMf/n9AN5xGWJyEXwceAxKNZW596g:5H/s9uzPMQJTNiVELRMfPIckeSsw59v

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 7 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LocalServiceComponents.exe
    "C:\Users\Admin\AppData\Local\Temp\LocalServiceComponents.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\is-2P8NF.tmp\LocalServiceComponents.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-2P8NF.tmp\LocalServiceComponents.tmp" /SL5="$7011C,17108969,53760,C:\Users\Admin\AppData\Local\Temp\LocalServiceComponents.exe"
      2⤵
      • Adds Run key to start application
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
        "C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:2268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\LocalServiceComponents\AnalyzeData.dll

    Filesize

    401KB

    MD5

    4fbdd0218255a93d43279b5683c87efb

    SHA1

    804f16f258089910fd7f96dd5af86c62c3e19b7e

    SHA256

    437b778801f5bc24bfc6331690790402ce05e0032953ffad11a6651e1b92e805

    SHA512

    30d452f55f79f1dcf80a1e5cd316648d53421e924d75d50f67d1b097faf79ed0e4eff9948746a446ea6447eace3742f94275aeadc5a5ab6e778403923ae34f90

  • C:\Program Files (x86)\LocalServiceComponents\AnalyzeData.dll

    Filesize

    401KB

    MD5

    4fbdd0218255a93d43279b5683c87efb

    SHA1

    804f16f258089910fd7f96dd5af86c62c3e19b7e

    SHA256

    437b778801f5bc24bfc6331690790402ce05e0032953ffad11a6651e1b92e805

    SHA512

    30d452f55f79f1dcf80a1e5cd316648d53421e924d75d50f67d1b097faf79ed0e4eff9948746a446ea6447eace3742f94275aeadc5a5ab6e778403923ae34f90

  • C:\Program Files (x86)\LocalServiceComponents\AnalyzeData.dll

    Filesize

    401KB

    MD5

    4fbdd0218255a93d43279b5683c87efb

    SHA1

    804f16f258089910fd7f96dd5af86c62c3e19b7e

    SHA256

    437b778801f5bc24bfc6331690790402ce05e0032953ffad11a6651e1b92e805

    SHA512

    30d452f55f79f1dcf80a1e5cd316648d53421e924d75d50f67d1b097faf79ed0e4eff9948746a446ea6447eace3742f94275aeadc5a5ab6e778403923ae34f90

  • C:\Program Files (x86)\LocalServiceComponents\AudioIntercom.dll

    Filesize

    2.2MB

    MD5

    964e43768a908d5dcd7d414fe7b4422e

    SHA1

    dbf116c0ca953a46f2de5dc41acd51bd75cea1cd

    SHA256

    bda8c3a87194409fb51ce72553c78cf3df61ae4f23700203940b4d0669577229

    SHA512

    1ab7ea429c594c9bdb335694f8f24a19ad1f7390a3becce912b3b4ef4f40865783bceb96599bddb3819f38dafd8cf96c2fe339b9554573138072f23b62edcf04

  • C:\Program Files (x86)\LocalServiceComponents\AudioIntercom.dll

    Filesize

    2.2MB

    MD5

    964e43768a908d5dcd7d414fe7b4422e

    SHA1

    dbf116c0ca953a46f2de5dc41acd51bd75cea1cd

    SHA256

    bda8c3a87194409fb51ce72553c78cf3df61ae4f23700203940b4d0669577229

    SHA512

    1ab7ea429c594c9bdb335694f8f24a19ad1f7390a3becce912b3b4ef4f40865783bceb96599bddb3819f38dafd8cf96c2fe339b9554573138072f23b62edcf04

  • C:\Program Files (x86)\LocalServiceComponents\AudioIntercom.dll

    Filesize

    2.2MB

    MD5

    964e43768a908d5dcd7d414fe7b4422e

    SHA1

    dbf116c0ca953a46f2de5dc41acd51bd75cea1cd

    SHA256

    bda8c3a87194409fb51ce72553c78cf3df61ae4f23700203940b4d0669577229

    SHA512

    1ab7ea429c594c9bdb335694f8f24a19ad1f7390a3becce912b3b4ef4f40865783bceb96599bddb3819f38dafd8cf96c2fe339b9554573138072f23b62edcf04

  • C:\Program Files (x86)\LocalServiceComponents\AudioProcess.dll

    Filesize

    650KB

    MD5

    ceb25b8c43e4dc3257ae3cef9c937671

    SHA1

    5970cbe813f5a98884db0d9a396ef1dd5c8f7ae9

    SHA256

    e1f95d02e9c621b5e15600df81f1cbd853ed823ba1197f85bae17924aa0c2eb8

    SHA512

    5462e931b4627aacae4cf9c58a64c400bedc045992d9174c962165f63a6b32e5e4531a9c92e089e78077ea85e81bc87d5bc744588cbb158b1f0106ea24ffa2f4

  • C:\Program Files (x86)\LocalServiceComponents\AudioProcess.dll

    Filesize

    650KB

    MD5

    ceb25b8c43e4dc3257ae3cef9c937671

    SHA1

    5970cbe813f5a98884db0d9a396ef1dd5c8f7ae9

    SHA256

    e1f95d02e9c621b5e15600df81f1cbd853ed823ba1197f85bae17924aa0c2eb8

    SHA512

    5462e931b4627aacae4cf9c58a64c400bedc045992d9174c962165f63a6b32e5e4531a9c92e089e78077ea85e81bc87d5bc744588cbb158b1f0106ea24ffa2f4

  • C:\Program Files (x86)\LocalServiceComponents\AudioProcess.dll

    Filesize

    650KB

    MD5

    ceb25b8c43e4dc3257ae3cef9c937671

    SHA1

    5970cbe813f5a98884db0d9a396ef1dd5c8f7ae9

    SHA256

    e1f95d02e9c621b5e15600df81f1cbd853ed823ba1197f85bae17924aa0c2eb8

    SHA512

    5462e931b4627aacae4cf9c58a64c400bedc045992d9174c962165f63a6b32e5e4531a9c92e089e78077ea85e81bc87d5bc744588cbb158b1f0106ea24ffa2f4

  • C:\Program Files (x86)\LocalServiceComponents\AudioRender.dll

    Filesize

    148KB

    MD5

    ee8d413f3c1237da57a8061ffdcbd261

    SHA1

    0be819cbd7bf17f07fc79a3d602b40c82cdf261d

    SHA256

    2f1736427b9d1e320a1ff48c631198981ef876f8c354ffd082ba43f40e987193

    SHA512

    9f0a822b687f0e0884de98206d793fc9f31fd8c2c63208f37a43078bd6024f4d29086448205485a71e05392c94ee8e3123cd6c7eaafbd40834dbd3c1c7b61626

  • C:\Program Files (x86)\LocalServiceComponents\AudioRender.dll

    Filesize

    148KB

    MD5

    ee8d413f3c1237da57a8061ffdcbd261

    SHA1

    0be819cbd7bf17f07fc79a3d602b40c82cdf261d

    SHA256

    2f1736427b9d1e320a1ff48c631198981ef876f8c354ffd082ba43f40e987193

    SHA512

    9f0a822b687f0e0884de98206d793fc9f31fd8c2c63208f37a43078bd6024f4d29086448205485a71e05392c94ee8e3123cd6c7eaafbd40834dbd3c1c7b61626

  • C:\Program Files (x86)\LocalServiceComponents\HPSClient.dll

    Filesize

    1.4MB

    MD5

    669577386aaa50c98a8e4202d0030e70

    SHA1

    ec14b39976d23ab10d2c4d17af86e40b3c08dcb6

    SHA256

    8ede5ece1ecda2e394c0f6bc1b8c1ac0d56bc91efb17ca102e26cc2d7608c813

    SHA512

    b5dec66424e7fc9c21a88b059e06fa69cc4741be5321a5784c791e209a32f0c31132eabac306d82d67028c324e0416383a20750486eb9e5cb269316d77297c03

  • C:\Program Files (x86)\LocalServiceComponents\HPSClient.dll

    Filesize

    1.4MB

    MD5

    669577386aaa50c98a8e4202d0030e70

    SHA1

    ec14b39976d23ab10d2c4d17af86e40b3c08dcb6

    SHA256

    8ede5ece1ecda2e394c0f6bc1b8c1ac0d56bc91efb17ca102e26cc2d7608c813

    SHA512

    b5dec66424e7fc9c21a88b059e06fa69cc4741be5321a5784c791e209a32f0c31132eabac306d82d67028c324e0416383a20750486eb9e5cb269316d77297c03

  • C:\Program Files (x86)\LocalServiceComponents\HPSClient.dll

    Filesize

    1.4MB

    MD5

    669577386aaa50c98a8e4202d0030e70

    SHA1

    ec14b39976d23ab10d2c4d17af86e40b3c08dcb6

    SHA256

    8ede5ece1ecda2e394c0f6bc1b8c1ac0d56bc91efb17ca102e26cc2d7608c813

    SHA512

    b5dec66424e7fc9c21a88b059e06fa69cc4741be5321a5784c791e209a32f0c31132eabac306d82d67028c324e0416383a20750486eb9e5cb269316d77297c03

  • C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe

    Filesize

    482KB

    MD5

    0efd3badad8b1f2c0eae5bc1f154835f

    SHA1

    74ae35da6f7f07b3b919c48a63f3edbbcb426e0e

    SHA256

    14edf0b852a61fcfbbd1598b471f5b5be08f1de73ce055ab0b520dcbab353afb

    SHA512

    16cb7d785e4146d3ee682f0f9bf6cc66666a08cf67f83143f736b136881d8e15644db8b5da15ce3159784d2b819b4a0ddf9280c0d846ac1811f5007e150fc7e6

  • C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe

    Filesize

    482KB

    MD5

    0efd3badad8b1f2c0eae5bc1f154835f

    SHA1

    74ae35da6f7f07b3b919c48a63f3edbbcb426e0e

    SHA256

    14edf0b852a61fcfbbd1598b471f5b5be08f1de73ce055ab0b520dcbab353afb

    SHA512

    16cb7d785e4146d3ee682f0f9bf6cc66666a08cf67f83143f736b136881d8e15644db8b5da15ce3159784d2b819b4a0ddf9280c0d846ac1811f5007e150fc7e6

  • C:\Program Files (x86)\LocalServiceComponents\MSVCP120.dll

    Filesize

    444KB

    MD5

    fd5cabbe52272bd76007b68186ebaf00

    SHA1

    efd1e306c1092c17f6944cc6bf9a1bfad4d14613

    SHA256

    87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

    SHA512

    1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

  • C:\Program Files (x86)\LocalServiceComponents\MSVCR120.dll

    Filesize

    948KB

    MD5

    034ccadc1c073e4216e9466b720f9849

    SHA1

    f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    SHA256

    86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    SHA512

    5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

  • C:\Program Files (x86)\LocalServiceComponents\NetStream.dll

    Filesize

    472KB

    MD5

    c371fab8851b66df65a55803ed6069f5

    SHA1

    2b7d4ff86d83d2ac8c58d5df966c487547d4ecc9

    SHA256

    216f700c3c5622017322046103d024e3f8d6a5fdf9f2d206b40e904dabe6da40

    SHA512

    90fe9e9040f30257878388cf9cf10041fedbecb9d05a4f85032106685f060c426d08f68226a53b559999664a846be7cff52605e1dbe1f0544b202cc9450eb3ca

  • C:\Program Files (x86)\LocalServiceComponents\NetStream.dll

    Filesize

    472KB

    MD5

    c371fab8851b66df65a55803ed6069f5

    SHA1

    2b7d4ff86d83d2ac8c58d5df966c487547d4ecc9

    SHA256

    216f700c3c5622017322046103d024e3f8d6a5fdf9f2d206b40e904dabe6da40

    SHA512

    90fe9e9040f30257878388cf9cf10041fedbecb9d05a4f85032106685f060c426d08f68226a53b559999664a846be7cff52605e1dbe1f0544b202cc9450eb3ca

  • C:\Program Files (x86)\LocalServiceComponents\OpenAL32.dll

    Filesize

    367KB

    MD5

    f1ae1cea6a77616c739ac021c38eb910

    SHA1

    152b5379395c03270243610a293d1d7555be725d

    SHA256

    6d1626e2c850b15a6a1f0cac3ceec9f24a20f6ee3a9c4199f9bf2e02ca5dd2c8

    SHA512

    b2118491b4b0fbb37103bfb2b76fdbe68be969ef1ff9106012fffb94efdce9b76ef2290313d6d563ed943472d3e9babf85f7b8bd2b254293d2c8c6706384e79b

  • C:\Program Files (x86)\LocalServiceComponents\OpenAL32.dll

    Filesize

    367KB

    MD5

    f1ae1cea6a77616c739ac021c38eb910

    SHA1

    152b5379395c03270243610a293d1d7555be725d

    SHA256

    6d1626e2c850b15a6a1f0cac3ceec9f24a20f6ee3a9c4199f9bf2e02ca5dd2c8

    SHA512

    b2118491b4b0fbb37103bfb2b76fdbe68be969ef1ff9106012fffb94efdce9b76ef2290313d6d563ed943472d3e9babf85f7b8bd2b254293d2c8c6706384e79b

  • C:\Program Files (x86)\LocalServiceComponents\PlayCtrl.dll

    Filesize

    4.5MB

    MD5

    0a9503bca189bea63fd8a9ae939837a9

    SHA1

    e76c89e43b40fb92baef9a71395d31c1fa1c8582

    SHA256

    66f98ae62f772f53ce735bce1d1f092c9fa9bc22403599967f8ea9aa15b4e21c

    SHA512

    fe57741751070329911df681ca5aacb05bd214e880bf8517b9968a1a09c336b65cffb3c7046d44bd4b48c4c5d94d95925559e08e68dc105c426fd51004875845

  • C:\Program Files (x86)\LocalServiceComponents\PlayCtrl.dll

    Filesize

    4.5MB

    MD5

    0a9503bca189bea63fd8a9ae939837a9

    SHA1

    e76c89e43b40fb92baef9a71395d31c1fa1c8582

    SHA256

    66f98ae62f772f53ce735bce1d1f092c9fa9bc22403599967f8ea9aa15b4e21c

    SHA512

    fe57741751070329911df681ca5aacb05bd214e880bf8517b9968a1a09c336b65cffb3c7046d44bd4b48c4c5d94d95925559e08e68dc105c426fd51004875845

  • C:\Program Files (x86)\LocalServiceComponents\PlayCtrl.dll

    Filesize

    4.5MB

    MD5

    0a9503bca189bea63fd8a9ae939837a9

    SHA1

    e76c89e43b40fb92baef9a71395d31c1fa1c8582

    SHA256

    66f98ae62f772f53ce735bce1d1f092c9fa9bc22403599967f8ea9aa15b4e21c

    SHA512

    fe57741751070329911df681ca5aacb05bd214e880bf8517b9968a1a09c336b65cffb3c7046d44bd4b48c4c5d94d95925559e08e68dc105c426fd51004875845

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Core.dll

    Filesize

    4.5MB

    MD5

    31ac6dc9d6f1212d1a93a27f44f680dc

    SHA1

    d77c61ba1bc212e5760d1c4da538e70b20c61ebc

    SHA256

    4c725b81cf3432ca84c3f8c576580fb45a3628596733972ee37571c6df17c877

    SHA512

    3c12e6a865ae023d6fecfb4512805610a9ee0f5a88bcfef19d5a53fb3b4aa37c5c2df40b9807ade1651de88418ccab91435e456229fd43cf225da5210b6d1d95

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Core.dll

    Filesize

    4.5MB

    MD5

    31ac6dc9d6f1212d1a93a27f44f680dc

    SHA1

    d77c61ba1bc212e5760d1c4da538e70b20c61ebc

    SHA256

    4c725b81cf3432ca84c3f8c576580fb45a3628596733972ee37571c6df17c877

    SHA512

    3c12e6a865ae023d6fecfb4512805610a9ee0f5a88bcfef19d5a53fb3b4aa37c5c2df40b9807ade1651de88418ccab91435e456229fd43cf225da5210b6d1d95

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Gui.dll

    Filesize

    4.8MB

    MD5

    1ebed79e43e535d550aeaf329980382e

    SHA1

    e16220879a48c52ae37b012d11d9bf389348e8c3

    SHA256

    d1d78071e7b15091e293ce1ec6009b5174cd43bcd0aaa67f9c1dffedc6fa1eba

    SHA512

    d5ec860f4ba5e7b889dca059bd5ef2cc95562ede02fb241334512feb96d3b3b821edfe284248bf3fc23c68a60c21c718f403323b5e1e170021546914e411400f

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Gui.dll

    Filesize

    4.8MB

    MD5

    1ebed79e43e535d550aeaf329980382e

    SHA1

    e16220879a48c52ae37b012d11d9bf389348e8c3

    SHA256

    d1d78071e7b15091e293ce1ec6009b5174cd43bcd0aaa67f9c1dffedc6fa1eba

    SHA512

    d5ec860f4ba5e7b889dca059bd5ef2cc95562ede02fb241334512feb96d3b3b821edfe284248bf3fc23c68a60c21c718f403323b5e1e170021546914e411400f

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Network.dll

    Filesize

    832KB

    MD5

    255871994e82efe4e8451c7895c0d331

    SHA1

    4433fc5123535b56b015512a974a6254e8adfe0a

    SHA256

    c8ffb561048f93de74de9f8836dbb5832f12d1d5e9dad714941b4a6005db55db

    SHA512

    687fdd81c35b2520e51acf397b7f39ba1c9e86c6a4cdcc2cf6a4b5199ea374a763453b5fc926731a8d71f9098ad00f8c0ba41267d621395c353914c6b9c6a5e7

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Network.dll

    Filesize

    832KB

    MD5

    255871994e82efe4e8451c7895c0d331

    SHA1

    4433fc5123535b56b015512a974a6254e8adfe0a

    SHA256

    c8ffb561048f93de74de9f8836dbb5832f12d1d5e9dad714941b4a6005db55db

    SHA512

    687fdd81c35b2520e51acf397b7f39ba1c9e86c6a4cdcc2cf6a4b5199ea374a763453b5fc926731a8d71f9098ad00f8c0ba41267d621395c353914c6b9c6a5e7

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Widgets.dll

    Filesize

    4.3MB

    MD5

    ca3b4ffb2df4e5fc626e2a445d7e134d

    SHA1

    b85d9c40b9078b4c3b96956585b0a858ed4cb612

    SHA256

    09d216a5590e9b2c3b6a57a481ca06730ea304feb5efe1a1f4f8a76f12fdbffd

    SHA512

    184726d0cf7311cab212d9bd7e28188cc500ba9d864cc240e4f7d731a963b5a3dafe5dd1d2d236380140d72a32ebe63b8b1bea2a8a09f56595d7660659c44890

  • C:\Program Files (x86)\LocalServiceComponents\Qt5Widgets.dll

    Filesize

    4.3MB

    MD5

    ca3b4ffb2df4e5fc626e2a445d7e134d

    SHA1

    b85d9c40b9078b4c3b96956585b0a858ed4cb612

    SHA256

    09d216a5590e9b2c3b6a57a481ca06730ea304feb5efe1a1f4f8a76f12fdbffd

    SHA512

    184726d0cf7311cab212d9bd7e28188cc500ba9d864cc240e4f7d731a963b5a3dafe5dd1d2d236380140d72a32ebe63b8b1bea2a8a09f56595d7660659c44890

  • C:\Program Files (x86)\LocalServiceComponents\StreamTransClient.dll

    Filesize

    705KB

    MD5

    f5d333a6c85d6774315cda14aab38df8

    SHA1

    f89785af024262515d4e36c1854022fbc913930c

    SHA256

    ad21c03e60bc41ae688d4bbede5d8b378ec4e29d3dff06b3b55d13cd8f1f84f8

    SHA512

    e17943e95c8074d51c2b060998f01a4dc6015a1c691287877b2809453ac856039d833af196d49717ee15b6edf072b24d419454e052815bbc30b581bb1986444e

  • C:\Program Files (x86)\LocalServiceComponents\StreamTransClient.dll

    Filesize

    705KB

    MD5

    f5d333a6c85d6774315cda14aab38df8

    SHA1

    f89785af024262515d4e36c1854022fbc913930c

    SHA256

    ad21c03e60bc41ae688d4bbede5d8b378ec4e29d3dff06b3b55d13cd8f1f84f8

    SHA512

    e17943e95c8074d51c2b060998f01a4dc6015a1c691287877b2809453ac856039d833af196d49717ee15b6edf072b24d419454e052815bbc30b581bb1986444e

  • C:\Program Files (x86)\LocalServiceComponents\SystemTransform.dll

    Filesize

    735KB

    MD5

    1cb152555e7e278f6b8cca07876c5ba7

    SHA1

    badfb584f942424f7fb7486a7b2757094f742db8

    SHA256

    47d210083c48d52fa4d4671c18a222b0c803160025451ee49b425edce81fb99f

    SHA512

    5efd5c201dacb992eda7f66b978cd61c5f873c4d6d56f381a8baeaa45311615ea137ab8d8581e87b8608eb699b2c39900a42499995243e6ccee4fde50fe6eeb3

  • C:\Program Files (x86)\LocalServiceComponents\VCRUNTIME140.dll

    Filesize

    81KB

    MD5

    8e65e033799eb9fd46bc5c184e7d1b85

    SHA1

    e1cc5313be1f7df4c43697f8f701305585fe4e71

    SHA256

    be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

    SHA512

    e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

  • C:\Program Files (x86)\LocalServiceComponents\hlog.dll

    Filesize

    925KB

    MD5

    a3579398ce491d26841ed833a0017aa5

    SHA1

    ffa1d29b6f3f3493347932aedc0b1a2a733f65d2

    SHA256

    305efefbfcf86b57bfd5961ff84001840786a08cb748144de54205123da77fef

    SHA512

    17181bf07029451c5051e445149e885d3b7479daec1692c266d4c5a173e4bdcc5ac9eec70b9e4072589e674dd45c43ccbe5ddcfc975d7b9780368e695dc6f20c

  • C:\Program Files (x86)\LocalServiceComponents\hpr.dll

    Filesize

    176KB

    MD5

    d499ade35f5a945c13cd3b3b1922050c

    SHA1

    bedb2d66daf44b2c2fe2d0c87d90ab4a7e8a0154

    SHA256

    a45e9d9d36b3e723661826c68bbe4c398987d6741b96db7fbddff340e6906253

    SHA512

    6d8cd9b87acfc40ea2ea19af45cda5b63044d008f92a1cb11d8a9533561c00e84eb621987d92f8a1fae4daa4ed4a13239dbdc90160040671ae52c630ed4252d6

  • C:\Program Files (x86)\LocalServiceComponents\hpr.dll

    Filesize

    176KB

    MD5

    d499ade35f5a945c13cd3b3b1922050c

    SHA1

    bedb2d66daf44b2c2fe2d0c87d90ab4a7e8a0154

    SHA256

    a45e9d9d36b3e723661826c68bbe4c398987d6741b96db7fbddff340e6906253

    SHA512

    6d8cd9b87acfc40ea2ea19af45cda5b63044d008f92a1cb11d8a9533561c00e84eb621987d92f8a1fae4daa4ed4a13239dbdc90160040671ae52c630ed4252d6

  • C:\Program Files (x86)\LocalServiceComponents\htrace.dll

    Filesize

    37KB

    MD5

    5150f49e9fd2512221a6bc1f6e38d9d3

    SHA1

    93e9b0419ce56f72a1acddec3ea66b9524fc20eb

    SHA256

    fac62ddc2cb10a480da8bc1c12d677474ab29f86d8020ca275f914c0628ced96

    SHA512

    7a4b225be8be207cfcb768b4c87ef3a6c2f3ff44776c0bbfceee51c89b7d1fbf62f23e39ccdceb47876e45b46519ccd9d7bfb9a2146912dc810d5d3fd3ff935d

  • C:\Program Files (x86)\LocalServiceComponents\htrace.dll

    Filesize

    37KB

    MD5

    5150f49e9fd2512221a6bc1f6e38d9d3

    SHA1

    93e9b0419ce56f72a1acddec3ea66b9524fc20eb

    SHA256

    fac62ddc2cb10a480da8bc1c12d677474ab29f86d8020ca275f914c0628ced96

    SHA512

    7a4b225be8be207cfcb768b4c87ef3a6c2f3ff44776c0bbfceee51c89b7d1fbf62f23e39ccdceb47876e45b46519ccd9d7bfb9a2146912dc810d5d3fd3ff935d

  • C:\Program Files (x86)\LocalServiceComponents\is-J21BD.tmp

    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

  • C:\Program Files (x86)\LocalServiceComponents\libcrypto-1_1.dll

    Filesize

    2.0MB

    MD5

    a4fa1b764ef76bd3f355048c09ea94c8

    SHA1

    364931522f73e05690f0820eeae5caa89ebb71e5

    SHA256

    4a5c4c4bbb2721a246ee12e34b73f9ccd38c680e827dfef9e7220bc23eb6ad6b

    SHA512

    d29c77f6ae441eb437820cb124d8d182bd2f3306561c7864a4061629ca0bbcf3429c0d2f6c6f66c52767200aff22767db6a1f85e41a9d84b11dede1909d9ce55

  • C:\Program Files (x86)\LocalServiceComponents\libcrypto-1_1.dll

    Filesize

    2.0MB

    MD5

    a4fa1b764ef76bd3f355048c09ea94c8

    SHA1

    364931522f73e05690f0820eeae5caa89ebb71e5

    SHA256

    4a5c4c4bbb2721a246ee12e34b73f9ccd38c680e827dfef9e7220bc23eb6ad6b

    SHA512

    d29c77f6ae441eb437820cb124d8d182bd2f3306561c7864a4061629ca0bbcf3429c0d2f6c6f66c52767200aff22767db6a1f85e41a9d84b11dede1909d9ce55

  • C:\Program Files (x86)\LocalServiceComponents\libcrypto-1_1.dll

    Filesize

    2.0MB

    MD5

    a4fa1b764ef76bd3f355048c09ea94c8

    SHA1

    364931522f73e05690f0820eeae5caa89ebb71e5

    SHA256

    4a5c4c4bbb2721a246ee12e34b73f9ccd38c680e827dfef9e7220bc23eb6ad6b

    SHA512

    d29c77f6ae441eb437820cb124d8d182bd2f3306561c7864a4061629ca0bbcf3429c0d2f6c6f66c52767200aff22767db6a1f85e41a9d84b11dede1909d9ce55

  • C:\Program Files (x86)\LocalServiceComponents\libssl-1_1.dll

    Filesize

    491KB

    MD5

    9b4f2db0319061698ddcf9ad9a26dd5f

    SHA1

    59a36614fc443a10bf4fb1f2e715892097d68b3e

    SHA256

    748838a17f04e3da984ff78701f78d0ede704c198d18b7ead4b71ffcd1980126

    SHA512

    d5cd03658064f27bddb262b0457125095fe2741d74e375b00512e26a6510272ced25eedb8aba21c94f52a2b2cd738a51faf16f9ccc764654da13a10a7013675b

  • C:\Program Files (x86)\LocalServiceComponents\libssl-1_1.dll

    Filesize

    491KB

    MD5

    9b4f2db0319061698ddcf9ad9a26dd5f

    SHA1

    59a36614fc443a10bf4fb1f2e715892097d68b3e

    SHA256

    748838a17f04e3da984ff78701f78d0ede704c198d18b7ead4b71ffcd1980126

    SHA512

    d5cd03658064f27bddb262b0457125095fe2741d74e375b00512e26a6510272ced25eedb8aba21c94f52a2b2cd738a51faf16f9ccc764654da13a10a7013675b

  • C:\Program Files (x86)\LocalServiceComponents\msvcp120.dll

    Filesize

    444KB

    MD5

    fd5cabbe52272bd76007b68186ebaf00

    SHA1

    efd1e306c1092c17f6944cc6bf9a1bfad4d14613

    SHA256

    87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

    SHA512

    1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

  • C:\Program Files (x86)\LocalServiceComponents\msvcp120.dll

    Filesize

    444KB

    MD5

    fd5cabbe52272bd76007b68186ebaf00

    SHA1

    efd1e306c1092c17f6944cc6bf9a1bfad4d14613

    SHA256

    87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

    SHA512

    1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

  • C:\Program Files (x86)\LocalServiceComponents\msvcr120.dll

    Filesize

    948KB

    MD5

    034ccadc1c073e4216e9466b720f9849

    SHA1

    f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    SHA256

    86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    SHA512

    5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

  • C:\Program Files (x86)\LocalServiceComponents\platforms\qwindows.dll

    Filesize

    997KB

    MD5

    7f4eaa37e14a5616f0efccae3e103d0b

    SHA1

    e68dea532df07cc40c203596297a45b8350ff9c8

    SHA256

    24cd825c14f434ca31316fe2b3e581799bbd87c1d5acda2e1d6645274b9e76d0

    SHA512

    aab85a923fc4f58a871287c7f046df6bc83538b3f196acef9c53eb152f371fa40996564eb594fec9631957ebc9f4b7d4081607bbd20bebe88ee94960ca0e9886

  • C:\Program Files (x86)\LocalServiceComponents\platforms\qwindows.dll

    Filesize

    997KB

    MD5

    7f4eaa37e14a5616f0efccae3e103d0b

    SHA1

    e68dea532df07cc40c203596297a45b8350ff9c8

    SHA256

    24cd825c14f434ca31316fe2b3e581799bbd87c1d5acda2e1d6645274b9e76d0

    SHA512

    aab85a923fc4f58a871287c7f046df6bc83538b3f196acef9c53eb152f371fa40996564eb594fec9631957ebc9f4b7d4081607bbd20bebe88ee94960ca0e9886

  • C:\Program Files (x86)\LocalServiceComponents\play_ctrl_config.xml

    Filesize

    677B

    MD5

    517dd3be8b7a2dd6c6807aa421241cfc

    SHA1

    4dd749854100fc6d7f9ec85dd3af499328826783

    SHA256

    c4edea2ddd52357af6de05979c76b8a8e42546b8f12dae631a2d8a2da4546024

    SHA512

    3bcfaa83bfc922003df58e6bc3128a13fa1601a9818f24cfc0bf1085af614c8f8cc0f8032462d2d545341a132a81c0e8a725742f3c9aa1c40d0229d95fc6942a

  • C:\Program Files (x86)\LocalServiceComponents\slf.dll

    Filesize

    176KB

    MD5

    b5123f2da52af37b2799e9cd24bf85ee

    SHA1

    34714663314742d302f1baa8526ca3f80c8a6161

    SHA256

    2f75b93e93c2a0f10a3f4dc8c33aa9fd4b064ae18b8346636285fbd93c8bf80d

    SHA512

    581feb840a9c9b352e842c1242071528c0a0d60d5ebbf4e319c7d21be46690e8373d327f34f9751433c1efbab7f75bfca7191bd24807b3059fd06031852ff757

  • C:\Program Files (x86)\LocalServiceComponents\slf.dll

    Filesize

    176KB

    MD5

    b5123f2da52af37b2799e9cd24bf85ee

    SHA1

    34714663314742d302f1baa8526ca3f80c8a6161

    SHA256

    2f75b93e93c2a0f10a3f4dc8c33aa9fd4b064ae18b8346636285fbd93c8bf80d

    SHA512

    581feb840a9c9b352e842c1242071528c0a0d60d5ebbf4e319c7d21be46690e8373d327f34f9751433c1efbab7f75bfca7191bd24807b3059fd06031852ff757

  • C:\Program Files (x86)\LocalServiceComponents\vag_playctrl.dll

    Filesize

    190KB

    MD5

    70e143f24dfde91e1e1621b6b40222e4

    SHA1

    94d586e8a0b7edfe133d3ac1aaefab8280bbc219

    SHA256

    6a79ce78c7e0d75958d3e7606f7b065478d538274fc0ab59ea0d052c6e0d7a7e

    SHA512

    c644d0132cb49c4f95028290603794d21ed930728403fc137f79e28e2508136039fbd344e4636b579d5d71913f1c61d58fc888444921024a182b5bbc52b453b9

  • C:\Program Files (x86)\LocalServiceComponents\vag_playctrl.dll

    Filesize

    190KB

    MD5

    70e143f24dfde91e1e1621b6b40222e4

    SHA1

    94d586e8a0b7edfe133d3ac1aaefab8280bbc219

    SHA256

    6a79ce78c7e0d75958d3e7606f7b065478d538274fc0ab59ea0d052c6e0d7a7e

    SHA512

    c644d0132cb49c4f95028290603794d21ed930728403fc137f79e28e2508136039fbd344e4636b579d5d71913f1c61d58fc888444921024a182b5bbc52b453b9

  • C:\Program Files (x86)\LocalServiceComponents\vcruntime140.dll

    Filesize

    81KB

    MD5

    8e65e033799eb9fd46bc5c184e7d1b85

    SHA1

    e1cc5313be1f7df4c43697f8f701305585fe4e71

    SHA256

    be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

    SHA512

    e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

  • C:\Program Files (x86)\LocalServiceComponents\video_control.dll

    Filesize

    948KB

    MD5

    9595ac30e55f83d0cb1e917d06b2272f

    SHA1

    e3dc83cbfa60e2ee2093513f48785effd103fc30

    SHA256

    da0b3fa5c6abea806b4145996e0896b982649a32588adf6406d8aaf56d4c4120

    SHA512

    6b345e734ba09dca6935b3dc7ef36bbe9e3ef88a066b8c0aee9e3fe3744d85dd91d9f0fc06c44d3c1ecb1064046761fad4a0c0c38f253918e50a4dbe5053488a

  • C:\Program Files (x86)\LocalServiceComponents\video_control.dll

    Filesize

    948KB

    MD5

    9595ac30e55f83d0cb1e917d06b2272f

    SHA1

    e3dc83cbfa60e2ee2093513f48785effd103fc30

    SHA256

    da0b3fa5c6abea806b4145996e0896b982649a32588adf6406d8aaf56d4c4120

    SHA512

    6b345e734ba09dca6935b3dc7ef36bbe9e3ef88a066b8c0aee9e3fe3744d85dd91d9f0fc06c44d3c1ecb1064046761fad4a0c0c38f253918e50a4dbe5053488a

  • C:\Users\Admin\AppData\Local\Temp\is-2P8NF.tmp\LocalServiceComponents.tmp

    Filesize

    680KB

    MD5

    9d321c7096f4bcaeb6f3d8d1636e1744

    SHA1

    c7797576432f72891986e81afd1be1c3aadbb79b

    SHA256

    43202b0de2e718d35cdf7eb8b34dd35bf3fae85c0ecd2108830230a121284322

    SHA512

    a4c3a0bb3090a8192ade70f83a1b3a4a74acfe3307fca7bbc70681ea93e88907ecae60023c9d608729dd179e6ffb991212ecb1040b2483b97efaf812ef731624

  • C:\Users\Admin\AppData\Local\Temp\is-2P8NF.tmp\LocalServiceComponents.tmp

    Filesize

    680KB

    MD5

    9d321c7096f4bcaeb6f3d8d1636e1744

    SHA1

    c7797576432f72891986e81afd1be1c3aadbb79b

    SHA256

    43202b0de2e718d35cdf7eb8b34dd35bf3fae85c0ecd2108830230a121284322

    SHA512

    a4c3a0bb3090a8192ade70f83a1b3a4a74acfe3307fca7bbc70681ea93e88907ecae60023c9d608729dd179e6ffb991212ecb1040b2483b97efaf812ef731624

  • C:\Users\Admin\AppData\Local\Temp\is-B919L.tmp\ISTask.dll

    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

  • C:\Users\Admin\AppData\Local\Temp\is-B919L.tmp\ISTask.dll

    Filesize

    66KB

    MD5

    86a1311d51c00b278cb7f27796ea442e

    SHA1

    ac08ac9d08f8f5380e2a9a65f4117862aa861a19

    SHA256

    e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

    SHA512

    129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

  • C:\Users\Admin\WebComponents\local.json

    Filesize

    1KB

    MD5

    8518748534458cda3b2da63e3a8cdd35

    SHA1

    d17acd9cd272a967c2c67743f7a7d15fdd5b6db5

    SHA256

    8c3f39ff5f9479dc095f07bed38acc9487ff209428d684ecc0bd24098d8bc334

    SHA512

    864419bf1f30652b63f5bdb55acfa60e01dcb4ba93b91b238bf5d851a07befa00710d58fa331057a6a947f41e0be078e7b92e8a44c2a3c1f32922eedb80408c1

  • memory/1904-149-0x0000000007210000-0x0000000007226000-memory.dmp

    Filesize

    88KB

  • memory/1904-144-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/1904-419-0x00000000021F0000-0x00000000021F1000-memory.dmp

    Filesize

    4KB

  • memory/1904-418-0x0000000007210000-0x0000000007226000-memory.dmp

    Filesize

    88KB

  • memory/1904-417-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/2268-401-0x0000000004C10000-0x0000000004C81000-memory.dmp

    Filesize

    452KB

  • memory/2268-413-0x0000000004FC0000-0x0000000005098000-memory.dmp

    Filesize

    864KB

  • memory/2268-383-0x0000000004A00000-0x0000000004C0F000-memory.dmp

    Filesize

    2.1MB

  • memory/2268-407-0x00000000050D0000-0x0000000005DC3000-memory.dmp

    Filesize

    12.9MB

  • memory/2268-415-0x0000000004F30000-0x0000000004F68000-memory.dmp

    Filesize

    224KB

  • memory/2268-387-0x0000000004CE0000-0x0000000004F28000-memory.dmp

    Filesize

    2.3MB

  • memory/2268-373-0x0000000004380000-0x0000000004884000-memory.dmp

    Filesize

    5.0MB

  • memory/3444-416-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3444-133-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB