gh0strat | ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe
Size

26.2MB
MD5

e9a61d220a0df35ea009b602eec9a9a7
SHA1

e9ef755041a907cd394d23da33784ab4a12c75a7
SHA256

ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531
SHA512

de8787231952a993f0c98c8f5268e171aa7c34b7722ed36e4ab4e418e116b67bab455069ce3507e5df3c9d66831b9c0f423bde6c8573161530e3f90a66a0b266
SSDEEP

393216:kgIRvV8Y6xX3F+Gt/SArbLAE+/HnC/XZ1LF8HhZhpVLiQ2V8BWmy9DEtNhE:D6OY6pBSArYLC/p1Lg/pVOhyBS9ehE

Score

10^/10

gh0strat purplefox discovery evasion rat rootkit themida trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral2/memory/2256-13102-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/2256-13108-0x0000000000400000-0x0000000001F8C000-memory.dmp	purplefox_rootkit
behavioral2/memory/6288-26222-0x0000000000400000-0x0000000001F8C000-memory.dmp	purplefox_rootkit
behavioral2/memory/14760-39442-0x0000000000400000-0x0000000001F8C000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral2/memory/2256-13102-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/2256-13108-0x0000000000400000-0x0000000001F8C000-memory.dmp	family_gh0strat
behavioral2/memory/6288-26222-0x0000000000400000-0x0000000001F8C000-memory.dmp	family_gh0strat
behavioral2/memory/14760-39442-0x0000000000400000-0x0000000001F8C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LineAppMgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LINE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LINE.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LINE.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	LineLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	LineUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	LineLauncher.exe

Executes dropped EXE 11 IoCs

pid	Process
2256	yqyfghg.exe
1896	LineInst.exe
6288	Tlctl.exe
14572	LineInst_240623718.exe
14760	Tlctl.exe
7700	LineAppMgr.exe
508	LineLauncher.exe
1000	LINE.exe
8604	LineUpdater.exe
13460	LineLauncher.exe
13528	LINE.exe

Loads dropped DLL 58 IoCs

pid	Process
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
7700	LineAppMgr.exe
7700	LineAppMgr.exe
7700	LineAppMgr.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
1000	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000a000000023b8b-39491.dat	themida
behavioral2/memory/7700-39499-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp	themida
behavioral2/memory/7700-39500-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp	themida
behavioral2/memory/7700-39501-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp	themida
behavioral2/memory/7700-39504-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LINE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LINE.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	Tlctl.exe
File opened (read-only)	\??\B:	Tlctl.exe
File opened (read-only)	\??\G:	Tlctl.exe
File opened (read-only)	\??\J:	Tlctl.exe
File opened (read-only)	\??\N:	Tlctl.exe
File opened (read-only)	\??\P:	Tlctl.exe
File opened (read-only)	\??\T:	Tlctl.exe
File opened (read-only)	\??\Z:	Tlctl.exe
File opened (read-only)	\??\E:	Tlctl.exe
File opened (read-only)	\??\L:	Tlctl.exe
File opened (read-only)	\??\M:	Tlctl.exe
File opened (read-only)	\??\Q:	Tlctl.exe
File opened (read-only)	\??\R:	Tlctl.exe
File opened (read-only)	\??\Y:	Tlctl.exe
File opened (read-only)	\??\X:	Tlctl.exe
File opened (read-only)	\??\I:	Tlctl.exe
File opened (read-only)	\??\K:	Tlctl.exe
File opened (read-only)	\??\O:	Tlctl.exe
File opened (read-only)	\??\S:	Tlctl.exe
File opened (read-only)	\??\U:	Tlctl.exe
File opened (read-only)	\??\V:	Tlctl.exe
File opened (read-only)	\??\W:	Tlctl.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	LINE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	LINE.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Tlctl.exe	yqyfghg.exe
File opened for modification	C:\Windows\SysWOW64\Tlctl.exe	yqyfghg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 38 IoCs

pid	Process
2256	yqyfghg.exe
2256	yqyfghg.exe
2256	yqyfghg.exe
6288	Tlctl.exe
2256	yqyfghg.exe
6288	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
7700	LineAppMgr.exe
1000	LINE.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
13528	LINE.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqyfghg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineInst_240623718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tlctl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tlctl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineInst.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
14752	cmd.exe
6672	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Tlctl.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Tlctl.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LINE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LINE.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Tlctl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Tlctl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Tlctl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Tlctl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Tlctl.exe

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\ = "URL:LINE Protocol"	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\shell\	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell\open	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell\open\	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LINE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\ = "URL:LINE Protocol"	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell\open\command	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\shell	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LineInst_240623718.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{AF6B7BE4-FFE1-4A0E-B99C-104776FAF884}	LINE.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{0D8F1433-CA73-4BB8-BD28-087122478523}	LINE.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\URL Protocol	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\shell\open	LineInst_240623718.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{0B0105EF-920B-4C3D-B260-70F5E6E9D24C}	LINE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\shell\open\	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\URL Protocol	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\DefaultIcon	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\",0"	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\shell\open\command	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\",0"	LineInst_240623718.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\lineb\shell\	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line	LineInst_240623718.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\line\DefaultIcon	LineInst_240623718.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{2A0896E3-BF4E-4093-9DF0-338F6D8165CB}	LINE.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
6672	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1000	LINE.exe
13528	LINE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe
14760	Tlctl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2256	yqyfghg.exe
Token: 33	14760	Tlctl.exe
Token: SeIncBasePriorityPrivilege	14760	Tlctl.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
14572	LineInst_240623718.exe
14572	LineInst_240623718.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe
13528	LINE.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1000	LINE.exe
13528	LINE.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 2256	4732	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe	86
PID 4732 wrote to memory of 2256	4732	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe	86
PID 4732 wrote to memory of 2256	4732	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe	86
PID 4732 wrote to memory of 1896	4732	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe	88
PID 4732 wrote to memory of 1896	4732	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe	88
PID 4732 wrote to memory of 1896	4732	ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe	88
PID 1896 wrote to memory of 14572	1896	LineInst.exe	98
PID 1896 wrote to memory of 14572	1896	LineInst.exe	98
PID 1896 wrote to memory of 14572	1896	LineInst.exe	98
PID 2256 wrote to memory of 14752	2256	yqyfghg.exe	99
PID 2256 wrote to memory of 14752	2256	yqyfghg.exe	99
PID 2256 wrote to memory of 14752	2256	yqyfghg.exe	99
PID 6288 wrote to memory of 14760	6288	Tlctl.exe	100
PID 6288 wrote to memory of 14760	6288	Tlctl.exe	100
PID 6288 wrote to memory of 14760	6288	Tlctl.exe	100
PID 14752 wrote to memory of 6672	14752	cmd.exe	103
PID 14752 wrote to memory of 6672	14752	cmd.exe	103
PID 14752 wrote to memory of 6672	14752	cmd.exe	103
PID 14572 wrote to memory of 7700	14572	LineInst_240623718.exe	105
PID 14572 wrote to memory of 7700	14572	LineInst_240623718.exe	105
PID 1896 wrote to memory of 508	1896	LineInst.exe	107
PID 1896 wrote to memory of 508	1896	LineInst.exe	107
PID 1896 wrote to memory of 508	1896	LineInst.exe	107
PID 508 wrote to memory of 1000	508	LineLauncher.exe	108
PID 508 wrote to memory of 1000	508	LineLauncher.exe	108
PID 1000 wrote to memory of 8604	1000	LINE.exe	109
PID 1000 wrote to memory of 8604	1000	LINE.exe	109
PID 1000 wrote to memory of 8604	1000	LINE.exe	109
PID 8604 wrote to memory of 13460	8604	LineUpdater.exe	111
PID 8604 wrote to memory of 13460	8604	LineUpdater.exe	111
PID 8604 wrote to memory of 13460	8604	LineUpdater.exe	111
PID 13460 wrote to memory of 13528	13460	LineLauncher.exe	112
PID 13460 wrote to memory of 13528	13460	LineLauncher.exe	112

C:\Users\Admin\AppData\Local\Temp\ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe
"C:\Users\Admin\AppData\Local\Temp\ab6bd75d672429a1ecbe7010082b3455b2b0b24952554788a5d1b33af0c77531.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\yqyfghg.exe
  "C:\Users\Admin\AppData\Local\Temp\yqyfghg.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\yqyfghg.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:14752
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6672
- C:\Users\Admin\AppData\Local\Temp\LineInst.exe
  "C:\Users\Admin\AppData\Local\Temp\LineInst.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Users\Admin\AppData\Local\Temp\LineInst_240623718.exe
    C:\Users\Admin\AppData\Local\Temp\\LineInst_240623718.exe /M
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:14572
  - - C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe
      "C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe" -afterinstall
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:7700
- - C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
    C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:508
  - - C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe
      "C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LINE.exe" run -t 240665781
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks system information in the registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1000
    - - C:\Users\Admin\AppData\Local\LINE\bin\LineUpdater.exe
        
        C:\Users\Admin\AppData\Local/LINE//bin/LineUpdater.exe --deploy 9.4.2.3477 en-US real 0
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:8604
      - C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
        
        "C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe" --updated 9.4.2.3477
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\LINE\bin\current\LINE.exe
        
        "C:\Users\Admin\AppData\Local\LINE\bin\current\LINE.exe" run --updated 9.4.2.3477 -t 240691843
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks system information in the registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:13528

C:\Windows\SysWOW64\Tlctl.exe
C:\Windows\SysWOW64\Tlctl.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6288
- C:\Windows\SysWOW64\Tlctl.exe
  C:\Windows\SysWOW64\Tlctl.exe -acsi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:14760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Line.exe

Filesize
27.8MB

MD5
4ef273b70ab77e96810ef5ca88418635

SHA1
87170abb677522f2ed7ba0dc19efb9149bdd7964

SHA256
6ff874bca4c566e07d8f5ecb62b7efb4ee9208d5b80b6d84caf0cf3b9a34738f

SHA512
3af9d552d6f548a89abe31711d4b482cf98e1f344192d14c2cc1d012930a234f1c94a90becd3a0e9421944def3fe3a3fd55d834d97de631f161e7f281d11d9be

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineAppMgr.exe

Filesize
3.1MB

MD5
02f554541e0036d6fd7bf2d333b7f0bf

SHA1
6a3f2d00bae392b184c7932f4e394b445ea8223c

SHA256
f822d5ee04cb5afb6c9ddf0a760c50196fb5e3b7221a665ac1329988f6565856

SHA512
53082de34cbf94ce9bc168dcee968f39abb00b88b4f99e327ab03113c508ffb1514b757f86e5bc4e2d3e0b577f9915e5b4675b7b3f154c1ec83565bd4eb69dcc

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineLauncher.exe

Filesize
1.7MB

MD5
a4bad7925d81ce54588a4b35063d0104

SHA1
d3198c1ed0e01610c2e45c13dddf6b3e49c0b4de

SHA256
ae2cc3ce522aa600a177e19a87e21871813977c70d0ca70cbb6cf6cf65f96aba

SHA512
e738a66b81b1cdb552d07ff974666178f94fa80d47dbb5c00994149152e70f53ab140efecec63c3206a68e948756cc6d2ba6c78ca970c56fc93c6cf64243ea85

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineUnInst.exe

Filesize
171KB

MD5
9ffb80552bcc00af65213874d2947463

SHA1
4726923498a8bcc6852e04a29e73f772d562a313

SHA256
be368ba9515ce60af62c64ea13da6c86e8dd9941b5ff2776f1ff013853367266

SHA512
c2f4e1d88f55f17148e22ca38cca91478d0ddad7bc29486327ab2db90365777ae073cdefd347cb36f4aa3b69f31493d69806ddf0b7e0ad8fb277c66e830ad651

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\LineUpdater.exe

Filesize
3.3MB

MD5
becf6bfcc9667284a88e46869d1bc46b

SHA1
d750e28982db7a1c90dc95d9dc0682a1f07818a5

SHA256
82249727558823b8471e98b3a8c18764d15318b812f1b9524d9040a4ae4f8657

SHA512
aeb54f1f9cdc26e8ffba241e4e185942fa468580102e8af4d4d04699e95e34cda5ee6752b55da30e9bec8031b3b399c1582f11076d3d57deb009fcccf59a4203

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\MSVCP140_1.dll

Filesize
34KB

MD5
ae146db58039e40b9b4bf1c6fb973d07

SHA1
ac0700813a2974f6d5b91c37ccabfff0302d7be0

SHA256
a61901a4d719a3e1cc4fa8f629218571330331e8dde2ef1f05c34845b180928e

SHA512
0ebef21b9935d498a749ac5b90719c23dec1f2209a8fdd17919cfca43aa098c64cad687643412dd61d1b4fa573e09e9f7b27a1e0f9a82bb892816045998a186f

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Core.dll

Filesize
5.9MB

MD5
6e953efa169f7746b90558aff0bf5c97

SHA1
1a1b5386dfe8eb412e3f414f766222dba93da32d

SHA256
0d3bf792b9b142ef10f9698f03921ba5d4e029a960975861453a38562e6341a4

SHA512
df54e6c030ec2197082a2134bb5632fad77a0d48cee9061c95746dcfbe4a24effa3cbcf0c0503809d074e4fa22aec3c931e563d765a166bc1008919e6ba69dc2

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Core5Compat.dll

Filesize
850KB

MD5
ae3eadcaea9606ff016f229425205922

SHA1
92e473a454893b8503790cc263e25bef1f9e6b21

SHA256
7284b02652c9a7becb9b463c1bd5b8213a2b1efa788a923a9c7a0d3261e66118

SHA512
e9129535fb89ba7a3d17d30f1274e00e016a06f1fce7b96fee6543a68bfbd0bceec03e1eebc2fd258d2ac2941c1e73494dd26e5024ffebf1cb82da65ac2b1165

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Gui.dll

Filesize
8.1MB

MD5
60a53995b0f470905a71a2400feb9fd9

SHA1
7c45ab27a13090f2704b80af94a36a9c30525588

SHA256
029055f9149aed18e5216a1793dbceee38c33f76399d61f9ae79a6f263794610

SHA512
2cfec5ec6be25d42594eff96dfa5711fec955d83c23ddc76637898b1eeba04ae7c3bd01c089a3fb2c48cf5745f263dda5c8f6221b0516394b79d850e7ea538ba

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Multimedia.dll

Filesize
852KB

MD5
68b21cbecaff415773eb99b4f0cb07b9

SHA1
1100fb139570dc278b7cd8a87cc30594d014b372

SHA256
8be4916abb8354b8f738873138fa61d13f805178d85f0bd35fe520e59575aef4

SHA512
7e7eafae138c81e29123dfc49bbb9366a2a0b1f600fb71d09fcd78818316bd4c710a0436dce19e48f2e54c2b8bdf55123052930d8f4d6c270ee3ff177ffaaa68

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Network.dll

Filesize
1.4MB

MD5
eb0bc1bd676ba558f92494f6e879b959

SHA1
f1d6bc4d0acd5a0f12910b42ac90cc1f369190c1

SHA256
a126ade93717aa5efa6b2d4a7623ab3b9de7ce79c86dcf12cf587e8182808ab9

SHA512
88bf24428424da06df25aabf54121aeff49481a781a445e08e98071f0a8e502b4ce41c78b1007bea5afa5cb6dc13bddaee453d79c2598c2ed4f569766c4e82ca

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6OpenGL.dll

Filesize
1.9MB

MD5
8f4e76ec9936bf1a42255acdb9b99127

SHA1
000a7556e905c79ec24e91f3a7b66834a4910bef

SHA256
97d91fe958e1a2491f9798c63bd78679fa12b6e8144c36297a3db4b73424063e

SHA512
e2dfe462315ffd36f100a64bc0cab4d855e476d9d2f278367be7f67d1c08f4c3c1c2af700726bb2695e7b66bab19f3aa943134e6ca342f830ed9649eaf9b76b8

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Qml.dll

Filesize
4.8MB

MD5
66d259c58aec3a291adc5582e8907dca

SHA1
649863e78c448920ba1fdaed6b7abfd9e4410d41

SHA256
09290ea947363728d35ffdf830045a3e21bc19af2967415e6ed1622fbec949df

SHA512
3cce3115c900d1c4f934243d936b89316466914087c5d312ed906a83e7e27ef2ec71f3eeec5612863f4ec7d8ad68862d2911350a717be3fe5e57e87cbdce7173

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6QmlModels.dll

Filesize
712KB

MD5
a247e51008d1967fd18e0bb51c70780a

SHA1
df9e84caf5141f070f3ee1c0cf952c03a80edb23

SHA256
614d9ca8838c7955f149892d7b4fd5f9b8067ca3fa5fe0c912eeb50245fc19b9

SHA512
6dd36d912e7668d27929c99ecd36b50d761e2128ea1ae30ff074a3656623a58a93cb6de9ee399ecaf6ddeb28ea10b57a1c85484fb3093e2d357afd9ebe480642

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Quick.dll

Filesize
5.3MB

MD5
3a9c568b4db6d9085079e7eb8b6372ea

SHA1
9fe0bcba8fe9170ee8101c7413983a5aaf1f385b

SHA256
682746073e9c1cca03b9eb12475cf0050b4bd0812d4dbe62e5ab1b40d9fd0b42

SHA512
24e9a6dc4a78cdbf2604d03a6de19ca75e7404ab5fce855336d1a7c68e129f3fa067f68554a55ae4bf04a998e02bdbe69cbd78af4bcca292480ce1a3d51ae4c7

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Svg.dll

Filesize
383KB

MD5
c2ffb9ea51a8a37a33bd8bdd59272db1

SHA1
a6ec79b0c765638c542dabf565b54eb49d5542d9

SHA256
3e8ce05635bb4d0154c5d882e3fddd993ad7bca8bd857eaf39cd35c135303cd3

SHA512
e67f825b2440c4ae97ecbe545a0afa95f6fa994ec5d91962cd78ca8b6834c926bdba415d56b633ce949023d15b902383bc3ba4d54f78fe706e02d99bf458f27f

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6TextToSpeech.dll

Filesize
140KB

MD5
e6803a778a125fc302b6b5ed412499b0

SHA1
bb360c2a16ed54369095478af1c60c01c566b76e

SHA256
680767cc9a9b68fe1154063b952fcd199c2bf5a1faa3f90efd45cef8cee810ea

SHA512
056d30a2bcd0fd3fbfeddff245ad46b4d28894c3cafa8e119c11e16b0f8782238e53178af010fec2ff7f5feebc4c58f197383784b51e53b3e6c755d140cf09c9

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\Qt6Widgets.dll

Filesize
6.1MB

MD5
ef277e18ff92658ea7a8d9b72ccfdfd2

SHA1
1b66db0116c923a2b9a336bb47748f781e31b431

SHA256
a5cfcc056dac0ad992102db8ac25e97384913e9e7047d370c8e858ee64a46999

SHA512
d0b5766b56682625ba36300e84539d02f9f342e55a4956f223df011a6a657558efa3d141f0e7191dab9a16945bc5a745217d7a1f7317158ed646f3c83ccf6104

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\WebView2Loader.dll

Filesize
135KB

MD5
bceebc73cb9e3f239b99575c0d38951c

SHA1
d71033e74b44ae5584b6be1d4cc99e4094f5aadf

SHA256
f86b7be36295297de21bffccfde3cef776e175478592b4b16c3063b420723312

SHA512
2cac4b095a46ab625ba7e4c9297133df1ccf3e87eb45938fc65c3ffe6cac31204229f3f4cedc6e58244bf74c76fbe9f2fda7710c784c79814e5ee2ccfb1994e7

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\dbghelp.dll

Filesize
1006KB

MD5
623c9754952a35b018f2448af8184075

SHA1
c37c32c391c509d0bfc8522ac7018a3c4b2a1940

SHA256
f089f6b1aa2a324603728c0453568201cb0ab6b8d3e8d6dcc2b000ad5cdfaba4

SHA512
7f848c186962abe6d9db18406ecf26f824216ebf44a4972f1681ac89a4b793dcc43287d3d1bbe8d13079e80d4718ca59fec500c2dd8e5f17b61035fc0b2b3c43

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\libcrypto-1_1-x64.dll

Filesize
2.2MB

MD5
2015b36a4ec425de3ffde0153f327b45

SHA1
977fcdd554a9b1455336a426738a5bbf7c5924be

SHA256
3e5ae8ff2bd0cd20656b83bd2e4375b038299cc6a85ef04c255b971d4317bc9c

SHA512
24a560133a0d63db91c5c8adbe2b22fc6bd46ed25b266aa9859ed5548cbf41ef48acd2307b66e479ef7a9fff2e74caed8d238bddc2b69dadc8984ee85712dd46

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\libnelo.dll

Filesize
2.4MB

MD5
b85488da78e6fee382de1726860b5f9a

SHA1
7e96fc54ba5b96bdded6bdf28fe1267133032def

SHA256
77018a7735e434822a2f52656be85546cab93bfd9388b750ebff6aa0a490a649

SHA512
23ec1cc429226a3172c25c1a46a52e02d5d8e1a314fa054dc6d2bb6948d33cfc26ad1f70a3ac7cbd9217226e3d304f84c9f5e066c6269e16b13a2a120592c0ee

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\libssl-1_1-x64.dll

Filesize
628KB

MD5
970996fc9b4cdbb10af6044507d5b7ae

SHA1
0e1b2957753c458ae9596901a6cf3c70839b39ec

SHA256
9fc18a126e7167f422a574a71243e04b9d73be666b24ea7a054822c6dbdf30e4

SHA512
b3a5e6a4ff24e918f2c278643e4b1270c69732199707b6db729b5b6c7d0af30c15c6eebf6a3fb36fe4208d12fa96c7713cbe7a00770233a51deb1b860af18ded

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\msvcp140.dll

Filesize
566KB

MD5
a62a22c33ed01a2cf362d3890ffa70e1

SHA1
ea3f55d92cdcb788876d689d394ec3225b1d222c

SHA256
003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89

SHA512
7da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\skottie.dll

Filesize
5.4MB

MD5
ce8f5d2f0f62c626edad01f0482448c7

SHA1
198b461b08220af35548b9ff143aefc78e5ee7a3

SHA256
e13ea4e788014abdf8c1cc8a02f2eb3f228c14a9ee810791842236ca1afdc4b7

SHA512
5710fb40c5e30eea64dfafff62cfe1b4a28c1be2844966a0ea36c192d83294582f57c92bee42c832d15d46e53eac0d66e02736bc6eb1bb1d3522840db3fea8a0

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\vcruntime140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.2.3477\vcruntime140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Users\Admin\AppData\Local\Temp\LineInst.exe

Filesize
1004KB

MD5
587e3bc21efaf428c87331decc9bfeb3

SHA1
a5b8ebeab4e3968673a61a95350b7f0bf60d7459

SHA256
b931c5686cc09b2183bba197dc151b8e95ca6151e39fb98954352340c0b31120

SHA512
ffae2dab5caf16dc7dfd0a97a8ff6349a466bc57ee043d1ac4d53e011498e39b9a855295d10207ba578c6857abebd445d378e83aa2ff6ec247713d81b370d0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\iV3Z3SmVPXW.exe

Filesize
1.5MB

MD5
6eb8c366315498feabd796786a621bcb

SHA1
3074fbe6287be713de51280d8277ab2f4b707155

SHA256
626db8bea999709c8faead0ec9d60025604676fcc44130abe6c1168b90989b3b

SHA512
dc28756c56c8ceffde09717e71212c5335e7cd1195105f6d5955a8ea3419e11b63669b03c5eba1a72be84adc9d92b0a3250a991b7c6a59817d3ffd21fc452733

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmD68C.tmp\System.dll

Filesize
11KB

MD5
d77839cc52a47e2db7d7fb944643fb0a

SHA1
ed3cd493e5a465a143862df3f280e936f3bd2fac

SHA256
93b73294a24201a4299fd0da7e0ab0dbffa130da300cc3a2c80d2aa7f2da7c77

SHA512
76f2739990bfae391f8c4c7346487150fa70eca82a15adff14e84d83ca03af5b202b8abab139f56b59dffd942a26aacdb359548367be7f80ff6bbf28b973e77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmD68C.tmp\UserInfo.dll

Filesize
4KB

MD5
6461ba2b54c2239503eff55de913c437

SHA1
7796499cc23eee4c522be381987913e6c5e8826e

SHA256
4658e40d14895f792cb5ea8bbee7dc95a6bff6478f8e41c3732a66b92fccc0d5

SHA512
12ae466bc824d57d8e44b5a2dca395b98f002fe3cfe4ed544939d7ce5480b174934adf4e9e06ea9d6907e64e180f1b1b6f9d25d607713ca23bb090f1cf3379cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsmD68C.tmp\killProc.dll

Filesize
89KB

MD5
b9edf77857f539db509c59673523150a

SHA1
23276a59846d61d0a1826ba3b3f3c4b47b257f20

SHA256
62f8e07d3ba5e9e57aaf529786a92931098f6ee33c6ab5057be5ad4ee0545b31

SHA512
8bedf1ffd4d5f1853e1794e32b7ff482c3c207a8d6600a54d9f0c583feac8711ac70c985f4579a947ee3c686e179dcdf42752bb45da2a5b9254f372265a92f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\yqyfghg.exe

Filesize
27.5MB

MD5
fc7f52ba7722c4beecbc550e6376a53f

SHA1
48649e85ae0181dee896cfa40369d8887bb0fb49

SHA256
7c3763106ba7b5f96ee7fc4411278737db191faf19bd0d5fd3cc4cc63f3f110a

SHA512
a401e6d587e25ac24fb47dce47468eb24250edaf5477d21d6eea7d7b8881916273034705d346519d530d61927ae80ce347d26852e71a89bb62b47747a6408c92

Download Submit
memory/1000-39563-0x00007FF72ABA0000-0x00007FF72F872000-memory.dmp

Filesize
76.8MB

Download
memory/1000-39562-0x00007FF72ABA0000-0x00007FF72F872000-memory.dmp

Filesize
76.8MB

Download
memory/1000-39566-0x00007FF72ABA0000-0x00007FF72F872000-memory.dmp

Filesize
76.8MB

Download
memory/1000-39558-0x00007FF91C980000-0x00007FF91CEC1000-memory.dmp

Filesize
5.3MB

Download
memory/1000-39559-0x00007FF91B9C0000-0x00007FF91BFD1000-memory.dmp

Filesize
6.1MB

Download
memory/1000-39565-0x00007FF72ABA0000-0x00007FF72F872000-memory.dmp

Filesize
76.8MB

Download
memory/1000-39564-0x00007FF72ABA0000-0x00007FF72F872000-memory.dmp

Filesize
76.8MB

Download
memory/1000-39561-0x00007FF72ABA0000-0x00007FF72F872000-memory.dmp

Filesize
76.8MB

Download
memory/2256-13096-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/2256-13108-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/2256-13101-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/2256-27-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/2256-3902-0x0000000077320000-0x00000000774C0000-memory.dmp

Filesize
1.6MB

Download
memory/2256-28-0x00000000775B0000-0x00000000777C5000-memory.dmp

Filesize
2.1MB

Download
memory/2256-13099-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/2256-5911-0x0000000075F60000-0x0000000075FDA000-memory.dmp

Filesize
488KB

Download
memory/2256-13098-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/2256-13102-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/2256-13097-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-13114-0x00000000775B0000-0x00000000777C5000-memory.dmp

Filesize
2.1MB

Download
memory/6288-16988-0x0000000077320000-0x00000000774C0000-memory.dmp

Filesize
1.6MB

Download
memory/6288-26222-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-26190-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-26213-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-26191-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-26189-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-26185-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-26184-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/6288-18997-0x0000000075F60000-0x0000000075FDA000-memory.dmp

Filesize
488KB

Download
memory/7700-39499-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp

Filesize
8.7MB

Download
memory/7700-39504-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp

Filesize
8.7MB

Download
memory/7700-39501-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp

Filesize
8.7MB

Download
memory/7700-39500-0x00007FF61AAC0000-0x00007FF61B36C000-memory.dmp

Filesize
8.7MB

Download
memory/14760-39303-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/14760-26223-0x00000000775B0000-0x00000000777C5000-memory.dmp

Filesize
2.1MB

Download
memory/14760-30097-0x0000000077320000-0x00000000774C0000-memory.dmp

Filesize
1.6MB

Download
memory/14760-32106-0x0000000075F60000-0x0000000075FDA000-memory.dmp

Filesize
488KB

Download
memory/14760-39297-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/14760-39300-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/14760-39442-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/14760-39305-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download
memory/14760-39301-0x0000000000400000-0x0000000001F8C000-memory.dmp

Filesize
27.5MB

Download