d543a5db2b7397b5432703bbf8d712dc5b0eaae8e4f85a4fd1fecdd16d1ad93d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LocalServiceComponents.exe
Size 12.5MB
Sample260727-pg92taag79
SHA256 d543a5db2b7397b5432703bbf8d712dc5b0eaae8e4f85a4fd1fecdd16d1ad93d
MD5 64231d50f247b6182531e46f10c9fee5
SHA1 7a98df067d28f8fe05f22e2f74abb2361ae858f3
SHA512 58e2259e3d6ccca197f63670e89d209f56b23e97cd14bdc31b8270541314d529d790c92e57a32c3c92743677b330a8b3c0b93aff28e60add9763918d6aab5935
SSDEEP 393216:QcRwHxJbpxNw02FiNAssezy4cuZY05hfwL/he8X:SxJNxNSFiyshVcueoWD
TLSH
T11BD6331B485592BDC09F1339E9FF55A08A227E3A6CAD750A71EFC5CE424762B270CB0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LocalServiceControl = "\"C:\\Program Files (x86)\\LocalServiceComponents\\LocalServiceControl.exe\""	LocalServiceComponents.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 44 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LocalServiceComponents\is-R2BGI.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-QF6O2.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-R7IBU.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-0DAAT.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\platforms\is-C39VK.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-K9JFP.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-Q3K27.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-29I8U.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-HO5JS.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-08G7P.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-S0N7U.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-0I010.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-URH5Q.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-HI03L.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-1IB3U.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-A0EC0.tmp	LocalServiceComponents.tmp
File opened for modification	C:\Program Files (x86)\LocalServiceComponents\unins000.dat	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-O733L.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-4BCOI.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-0BSP8.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-2KB1D.tmp	LocalServiceComponents.tmp
File opened for modification	C:\Program Files (x86)\LocalServiceComponents\PlayCtrl_LogStream.config	LocalServiceControl.exe
File created	C:\Program Files (x86)\LocalServiceComponents\is-QKVUE.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-NCD49.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-2RSDG.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-QP5U0.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-EFV1Q.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-KICID.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-FF2GU.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-P36F5.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-R5UP4.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-JK0FJ.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-FNBEU.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-OL2QR.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-NLQH6.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-I3TT6.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-NJ0LU.tmp	LocalServiceComponents.tmp
File opened for modification	C:\Program Files (x86)\LocalServiceComponents\AudioIntercom_LogStream.config	LocalServiceControl.exe
File created	C:\Program Files (x86)\LocalServiceComponents\unins000.dat	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-TSPMO.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-PK8PF.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-5C7US.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-T2V39.tmp	LocalServiceComponents.tmp
File created	C:\Program Files (x86)\LocalServiceComponents\is-E3DHR.tmp	LocalServiceComponents.tmp

Executes dropped EXE 2 IoCs

pid	Process
4300	LocalServiceComponents.tmp
4060	LocalServiceControl.exe

Loads dropped DLL 26 IoCs

pid	Process
4300	LocalServiceComponents.tmp
4300	LocalServiceComponents.tmp
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe
4060	LocalServiceControl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LocalServiceComponents.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LocalServiceComponents.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LocalServiceControl.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5768-0-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/5768-167-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/5768-171-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl\shell\open\command	LocalServiceComponents.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl\shell	LocalServiceComponents.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl\shell\open	LocalServiceComponents.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl\shell\open\command\ = "C:\\Program Files (x86)\\LocalServiceComponents\\LocalServiceControl.exe %1"	LocalServiceComponents.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl	LocalServiceComponents.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl\ = "LocalServiceControl"	LocalServiceComponents.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LocalServiceControl\URL Protocol	LocalServiceComponents.tmp

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4060	LocalServiceControl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4300	LocalServiceComponents.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4060	LocalServiceControl.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 4300	5768	LocalServiceComponents.exe	89
PID 4300 wrote to memory of 4060	4300	LocalServiceComponents.tmp	90

C:\Users\Admin\AppData\Local\Temp\LocalServiceComponents.exe
"C:\Users\Admin\AppData\Local\Temp\LocalServiceComponents.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Users\Admin\AppData\Local\Temp\is-PKIKE.tmp\LocalServiceComponents.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PKIKE.tmp\LocalServiceComponents.tmp" /SL5="$5005C,12849166,53760,C:\Users\Admin\AppData\Local\Temp\LocalServiceComponents.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
    "C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe"
    3⤵
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AudioIntercom.dll

Path C:\Program Files (x86)\LocalServiceComponents\AudioIntercom.dll
Size 2.3MB
SHA256 d5603fd43e93cf83dbd23b235d892fa5d17a3996b8c2325e6bdda4714898eff7
MD5 e127b2d42d422f0599c1f0e5d92f29ef
SHA1 f2eea4439c7cf8ddb588a40555e780d3d6423ccb
SHA512 7302bb701c4640ef834de31627ba3dd14b1daa47b88c7f52760239e261db8258fb930f432a54e337bd75cea2d69005be03b93a53d311b89065a85bf2f9b641fc
SSDEEP 24576:GwutYi1SsKumjx2XWBOe3e/5qnaehF4yoD/2aI2U+e/NT4qEStZqQ41z6xhzm3qe:GftYBH3e/5IF2D/3oNDEyaoxhzm3DUs
TLSH
T1BFB5D021F687C1F2C4D61130896B7F7A0A389E128B6649D37BD4BE36BD213D1973538A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioProcess.dll

Path C:\Program Files (x86)\LocalServiceComponents\AudioProcess.dll
Size 650KB
SHA256 f7b99b160f0c0a19c43e0ec82276e4b857882c90c9cf05d68eb184e75bb94b0b
MD5 078e1b5e824a7bbb9313c1cb2225d60a
SHA1 d27b9d6513c3c955e522df8dcaff327ce428f784
SHA512 20addd929d4a5de5ef71053e57a11d66d6dae27308074da28a2b704e3ff10c707e58a802662b6eefdb9f584edaa4f1c7b4a25d3517b74dc336d3c406e9401c04
SSDEEP 12288:BkVJ7ribjL+YtWkZca2cdVCVXV5V9beapDeD48di0i:BkVJ7rib95ZZHclLXz8di0i
TLSH
T137E49D13FB13C9E0C8661270843B6BB9597B2EF25B1106F73FB46A662D722D016F1267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AudioRender.dll

Path C:\Program Files (x86)\LocalServiceComponents\AudioRender.dll
Size 148KB
SHA256 6c03bb67ca29774c9d01d3b7e9fa79e6d8c596d7f4c016b828371f27825e2fb5
MD5 82097175353b44c4ac667b088e23729a
SHA1 902465c28e509aa109216eac5abc07332ff3de58
SHA512 4af2653c6155d74ee720a2c70a8540242e4844d38572cf58dc3959b6ddba1d007427528767d9e61155780407d259dbaa8fb9c0d71a404df85a178f274c559a2f
SSDEEP 1536:GPF93KPJDzLK+UHp4c5ufxoBpQtDavP/zih2DIBpkOerBPrLp4R4PTz:C5gSVufxkS6NrBPPGR4bz
TLSH
T195E38D307242C03BD9AB0179486B87B6A9393934077454DB7FC51EA9AF753D2AE3134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalServiceConfig.json

Path C:\Program Files (x86)\LocalServiceComponents\LocalServiceConfig.json
Size 183B
SHA256 d66c8a0995dff7884019d9c3b219e70cc1d620d7b390ae3811987fe757587111
MD5 c26cb31d931c644f7e6772dd5ea1ff30
SHA1 288ff2e3a7862c083f7bad4459d3e134adecda18
SHA512 a7ad5e0986eac9582baa05fc6d8da41cec8ed7791be9e42cfd869ea391bb74e4a2894523d7fdee4e60d03d2898003a7d1e1167207d39c5d690ebe077902905b2
TLSH
T13AC01202C4258D3B74AC99102EA11D82F64213BF4415295931FAC34E4FF541D51C5834
MD5 SHA1 SHA512 TLSH

Submit Download

LocalServiceControl.exe

Path C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
Size 502KB
SHA256 bdc89a5efcbd075746449aee3ca40fd3c3ccddc926bed87be76bc68fb969b3ec
MD5 1862bc96fad28bfd7bf4fc11809a9339
SHA1 04b0bb2380d93c00e97f529467678ffb0b711f31
SHA512 f17cc0d99eb8f8c90aae4f805f75d9429b9ff6a0aacbaf769357814b23775b40cbd593e9135ca8f002b4ac7c5bd2de56c3360d1b0c651939228ee01dbc41198f
SSDEEP 12288:+uzu910B2H4UIPMU+se9kNkcF1t4rXFByD6FSw7BexHelU4yup2jET2IflEmX5:zzu910Bg9kNkcF1t4rXFByD6FSEoxHej
TLSH
T102B4D6222F38C12BD3B561706F9FE66A9019C454075574EFB2C90AB724B19CB2A3DC7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Program Files (x86)\LocalServiceComponents\MSVCP120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetStream.dll

Path C:\Program Files (x86)\LocalServiceComponents\NetStream.dll
Size 500KB
SHA256 ca7f535679dfae47cd30a439d53d0e817aad30de974065ebf81f58a5bdf31b39
MD5 f51b5be6f6894e3b160d51bb3d77f137
SHA1 dfd2bb2dda0aca9f2ac0acc937b0c5ff3a7967dd
SHA512 8ecf11b2ef1778ee9021e13bf3caf4cd99e02fa8f3cdee496e5c2d9a2fbc7dc377a7a36ba7e5143a0e0a80230894d960bd475bf4b17a26bed6a0328a52f9d94a
SSDEEP 6144:YdH/+8MHxAcoi1szJuKAroUtcqVPB60O8uhU+00pSTiq4wmIsF:Yd+Hx/yk3CHhUt0YeqNmIc
TLSH
T10FB4B0023BC181B6C59B0130D9143F7EFBFDA7710A3B884797648D9E9E799979A2120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.dll

Path C:\Program Files (x86)\LocalServiceComponents\OpenAL32.dll
Size 1.1MB
SHA256 5e83ed250273071af04b7ef0a98d099ae9cd9f84b3d29be203119067460c146b
MD5 13e93834927fe96967d78c386ba9019c
SHA1 1da5979bd525a3486c11599387b02de407b662a4
SHA512 fd1d93df4f5942a8d47fa1c549c7d702893f7e4c349d7526a69a9540cfa40153efd3fac3ec804acbe64990a77fbc57d01b536359ec05647b5e33aaed56ad9922
SSDEEP 24576:K5XxiS0OrPLobz8TXlnI89cEPQlGAEdQ:oj9rkbzyRI89cEP4PE2
TLSH
T12845BE21B592C532C55D12715879BFAF903E65610B3408D7E3E8AEBDAE700D23B73A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlayCtrl.dll

Path C:\Program Files (x86)\LocalServiceComponents\PlayCtrl.dll
Size 6.2MB
SHA256 7d24d523ce8c40b10410aab4e2b11d3693833c4097fd353febace51388dfd4c9
MD5 fbd53a269e78668034974509e2a10acb
SHA1 35d7e6cc13698680254152912f5939e7e68c98f9
SHA512 c0266c7840302a3bc36016f73dafd57e3bbd17cef42a03bf67c336c251d6bd046d75f8ff04ddad71058305963d8b51ad3f873b427eb000aaabce22093f22c509
SSDEEP 196608:7YON0MNkldBRTLd/BMs84lMwBw2qmVm8nw:cMwHMs8822qmVm8
TLSH
T1FC669E61E383C029D5970871483F9BEF593D2B39831454DBA3C46E68FBB62D16630A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files (x86)\LocalServiceComponents\Qt5Core.dll
Size 4.5MB
SHA256 4c725b81cf3432ca84c3f8c576580fb45a3628596733972ee37571c6df17c877
MD5 31ac6dc9d6f1212d1a93a27f44f680dc
SHA1 d77c61ba1bc212e5760d1c4da538e70b20c61ebc
SHA512 3c12e6a865ae023d6fecfb4512805610a9ee0f5a88bcfef19d5a53fb3b4aa37c5c2df40b9807ade1651de88418ccab91435e456229fd43cf225da5210b6d1d95
SSDEEP 98304:8dS/SBS/PayG3fVkp9yJsv6tWKFdu9CPD:nwfVUyJsv6tWKFdu9CP
TLSH
T107267D93E79781B2FA82827648EBD22B0576AD1547019AD7F34C3A0B98716E13D3F14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files (x86)\LocalServiceComponents\Qt5Gui.dll
Size 4.8MB
SHA256 d1d78071e7b15091e293ce1ec6009b5174cd43bcd0aaa67f9c1dffedc6fa1eba
MD5 1ebed79e43e535d550aeaf329980382e
SHA1 e16220879a48c52ae37b012d11d9bf389348e8c3
SHA512 d5ec860f4ba5e7b889dca059bd5ef2cc95562ede02fb241334512feb96d3b3b821edfe284248bf3fc23c68a60c21c718f403323b5e1e170021546914e411400f
SSDEEP 49152:ocLeg66Ry8jdAYbppzo7Tzj1/JrRbkwW6Ydzzr3YCWizxCqDRkU9i4g1/JAy:NLrBpr1o7bRyfdzzxz0NTA
TLSH
T1E23619D1B1827173C9A2D3BA670F263FD0A6AD56C30482C3C655AEC558743FA1F7BA06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files (x86)\LocalServiceComponents\Qt5Network.dll
Size 832KB
SHA256 c8ffb561048f93de74de9f8836dbb5832f12d1d5e9dad714941b4a6005db55db
MD5 255871994e82efe4e8451c7895c0d331
SHA1 4433fc5123535b56b015512a974a6254e8adfe0a
SHA512 687fdd81c35b2520e51acf397b7f39ba1c9e86c6a4cdcc2cf6a4b5199ea374a763453b5fc926731a8d71f9098ad00f8c0ba41267d621395c353914c6b9c6a5e7
SSDEEP 12288:7fGeWXoifZwygBFp9RsVqSA3jk1x5X+JPnk4PpazkoLhVY9hqivwlsBNzARfG:7fGeWXoiBwHbHEgqM9BNzARfG
TLSH
T18B055B52B2CF00B6E58D61FA881DEF67E63CB114470656DFE35CAE1663213E11E3E286
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files (x86)\LocalServiceComponents\Qt5Widgets.dll
Size 4.3MB
SHA256 09d216a5590e9b2c3b6a57a481ca06730ea304feb5efe1a1f4f8a76f12fdbffd
MD5 ca3b4ffb2df4e5fc626e2a445d7e134d
SHA1 b85d9c40b9078b4c3b96956585b0a858ed4cb612
SHA512 184726d0cf7311cab212d9bd7e28188cc500ba9d864cc240e4f7d731a963b5a3dafe5dd1d2d236380140d72a32ebe63b8b1bea2a8a09f56595d7660659c44890
SSDEEP 49152:khk8cs4FhK1FKBxR8Lcdm0OTqZ7uA/GrXHIaTU+cDZ0V37SU:uk8ymoBxKAdmL8yONaQi32U
TLSH
T1FC268D83B2C101F1C8859275491FEF5BC5BBB1164B5652DBE38CEA0368683E12E7F687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StreamTransClient.dll

Path C:\Program Files (x86)\LocalServiceComponents\StreamTransClient.dll
Size 716KB
SHA256 582c6beea77eea768131061640d1779a4d276e67cc6d108673bd2a06fc1025e3
MD5 2c29cd8a929db538cd592adc901e14fe
SHA1 d8547e768aeb340905f005403c6f79e43b1712e0
SHA512 15fe30ed9964b7cbcd634a11a79b33779a4b73a2e08df8303b36aceb280754126ec23a0ba759051ebfbc658ce6bdbdb045cd1e5032a66532fa539834ce170cf7
SSDEEP 12288:gagb1Pe0X3PccYgtAhWXy7PyFGTaApAGtzuiX1l8VOTSvyQH67rKMnk:a5Pe0X0gtAhWi7PydkgiX1l8M86fJk
TLSH
T111F48D12BD80C135E1AA02B685BDBF2754FDB8710B3699D3A7D88A1E1E744C36B39347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Program Files (x86)\LocalServiceComponents\libcrypto-3.dll
Size 3.9MB
SHA256 6e05eb6af1fc42fd6c91df8dd8c47a1e2ed141a12602f0d3d5a08ff6d1f4473d
MD5 cd0dd4e77d9f30f59ab4e0b4eb9bd1b5
SHA1 b018088c855ca5e8f0370f278da98951ae6fbc70
SHA512 bba254c7c965e2b611111f4fdd938ea13470c3322cc1e23043924cfedaba01beefc118a728eefa6f09f3b75a1720369656601d4ac9c7d61d3205b76091dea0ec
SSDEEP 98304:xhn5vPnK+1cdxpC16asWGFrmzz1CPwDvt3uFlDC:353nK0arCA/bFrmf1CPwDvt3uFlDC
TLSH
T1A016AE12BB935291EDCF813E12EFA73F0D3C5A14C72499D38E6629E9C825AD1673E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Program Files (x86)\LocalServiceComponents\libssl-3.dll
Size 971KB
SHA256 132ec8570ed948306ed161150d9426c9b4d6f8bf31e0bdb2309f60db6acc0863
MD5 3f2e8ae907de939f323a0d99fde13a0b
SHA1 28ab1492a3f1e620d074bab1aaee667c3b407efb
SHA512 52d4b700a1322276a6ca1bae47fcf5f6bb554bfdade1634dc6d8d7eacf4c89094283f1502936735250a7bda6161efa1bcd0f65a457420f690f1843efabf9b1de
SSDEEP 12288:aSaAUig6A+Ciy954MPXsp1TK6WSWD7yU+nFN/7aenoTdeH2BvAKEC7hzcpHCXmFG:6Vio+XuCnXGeVKEClcpemFe9Xbp
TLSH
T1C5258D50B7828DA2DCEA80BD06FD7276053FA2215724CAC74B954AF9CD206D17A3B7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Program Files (x86)\LocalServiceComponents\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files (x86)\LocalServiceComponents\platforms\qwindows.dll
Size 997KB
SHA256 24cd825c14f434ca31316fe2b3e581799bbd87c1d5acda2e1d6645274b9e76d0
MD5 7f4eaa37e14a5616f0efccae3e103d0b
SHA1 e68dea532df07cc40c203596297a45b8350ff9c8
SHA512 aab85a923fc4f58a871287c7f046df6bc83538b3f196acef9c53eb152f371fa40996564eb594fec9631957ebc9f4b7d4081607bbd20bebe88ee94960ca0e9886
SSDEEP 24576:zIqDMndk36C66mKncbHaxw5XaO7eN2ZNL:cm4Wm6NcDaaNL
TLSH
T11D257D81E39349F2E5CA47B5117FBB3BC9367118037196C7D250A996AC212F27F3938A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

slf.dll

Path C:\Program Files (x86)\LocalServiceComponents\slf.dll
Size 204KB
SHA256 9bfbace53ddb8da438fd6b0082f9bce6a6b225548211f35008acdc0b3ec7472c
MD5 c1ccaa571d47eed30601d36e8968113f
SHA1 c2e13ace9c66e9294b3d15246c982c926e7340a9
SHA512 971d2c89c46dd46ca12519cd28a631003ffd568667f4c52839e7405385142cdc864cc2ab6ff8f6a9742aa75d1f62616b42193a845427f0483ea778f3d825df3d
SSDEEP 6144:cuH9U3g3D5LfH0zjmDXZjFb9eIVY2KHatBu:S3i5zY2MmY2Ma
TLSH
T13E14D001E8E16D3BDC6000B4635B7AEB543DFB301770D0A767956B48CB69BD0AAA7353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files (x86)\LocalServiceComponents\vcruntime140.dll
Size 81KB
SHA256 be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4
MD5 8e65e033799eb9fd46bc5c184e7d1b85
SHA1 e1cc5313be1f7df4c43697f8f701305585fe4e71
SHA512 e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd
SSDEEP 1536:AZYGvQ2+Ub54AE6ZkJrIriwx0AKGsu0g1kqwecbR7elB6zkz8EBmr:AZ7vQ2+a54AE0sAKxQwecbR7elzz8EUr
TLSH
T101837C11B4A84072D166997412AAEAB3B63DAA508FC54FCF6FED5CDC06B93C17332217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video_control.dll

Path C:\Program Files (x86)\LocalServiceComponents\video_control.dll
Size 1.0MB
SHA256 091dfa0881f4c0e2647a4157f026a0a616c38108ed0613540f8352b5d3cd958b
MD5 ab24839cd332e7aaa6a276f912351b93
SHA1 7f61e1816dae1371b88106c7fcfc91c44e79f85b
SHA512 0b750e5d4ca6e7045299eaaa6c40a75b087554337363176fdad4623a2267db2021c5b7763b8c8afac684ba6a10d49b763507a96b390e1aa98d31d1147fbfca5a
SSDEEP 24576:uZvZ6ubyuHQVtRtfZREQeRer/8vJ2dusdKM:mB6ug9fZREnRer/8vsdKM
TLSH
T1713508622E3C8134EFEC257E593C6A26C02DD5440735B1D7BA4A296B2A349D75F32CE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ISTask.dll

Path C:\Users\Admin\AppData\Local\Temp\is-5D8FF.tmp\ISTask.dll
Size 66KB
SHA256 e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
MD5 86a1311d51c00b278cb7f27796ea442e
SHA1 ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA512 129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
SSDEEP 1536:KVqiEnH9RGX9xXLUWB1GOlb3MvH4xK+RRlm9A:isGX3Vwwbc6Rlm9A
TLSH
T138635C07B6D08676E072AFBC5C39A214A63B7D353D35D0ADABB90D8D4E282C29D4C357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LocalServiceComponents.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PKIKE.tmp\LocalServiceComponents.tmp
Size 680KB
SHA256 43202b0de2e718d35cdf7eb8b34dd35bf3fae85c0ecd2108830230a121284322
MD5 9d321c7096f4bcaeb6f3d8d1636e1744
SHA1 c7797576432f72891986e81afd1be1c3aadbb79b
SHA512 a4c3a0bb3090a8192ade70f83a1b3a4a74acfe3307fca7bbc70681ea93e88907ecae60023c9d608729dd179e6ffb991212ecb1040b2483b97efaf812ef731624
SSDEEP 12288:p0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELAV2XEx9rz:BfKbT5lrPo37AzHTA63/cfU9IEU353gC
TLSH
T17EE47C32F2A0D837C1B31E789D1782955936FE103E39A5A776E91F0C4F79281792B2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

local.json

Path C:\Users\Admin\WebComponents\local.json
Size 1KB
SHA256 840fa52b5c0f3ffb4046b036f9bab074781902d113f4568a1b29d490b5693a63
MD5 4f885786c186a6f9f58d66037c8dc414
SHA1 acf6e469c32a0a7d815adb677122a213ea8395da
SHA512 c20621ea89983791f26af6e15d73608edfbdedc87741b6cf1fc9f008ee434b3d2c53465e684b0a75827a441f680a5dd3032f030a6c086d8edcfc1dada608e34d
TLSH
T198318165F016CD5B610103751AB0194B4A59857BAC803F0473A88CCDAF5E82FABF7E7E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4060-149-0x0000000005220000-0x00000000058F4000-memory.dmp

Download

memory/4300-168-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4300-14-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4300-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4300-19-0x00000000024E0000-0x00000000024F6000-memory.dmp

Download

memory/4300-169-0x00000000024E0000-0x00000000024F6000-memory.dmp

Download

memory/4300-170-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5768-2-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/5768-167-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5768-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5768-171-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads