gh0strat | 7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe
Size

51.1MB
MD5

d6016b628f54b6ab28b78cccf55b48df
SHA1

4bc214534ff2dfcf886ea424b2bb54de8525e0d8
SHA256

7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983
SHA512

16546a68c03640bce50d57a12169efda264c0fe218ea04e114a4a22d3b5d6a26e55b21b9ca76acd82c285391c9b89838eae069eae1d5e2b62b0795e6dc59900b
SSDEEP

786432:R6nLbSYjJrmA4P2EKsSeAGcrNY5L3idyWPI946n2pUTVPLb+0/iciM3HmEh6wTiT:Y+QEKsSeAfvVwe6n2qjb+7ciMZdm

Score

10^/10

gh0strat purplefox discovery evasion rat rootkit themida trojan

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/2564-13113-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/2564-26216-0x0000000000400000-0x0000000001F5C000-memory.dmp	purplefox_rootkit
behavioral2/memory/8816-26232-0x0000000000400000-0x0000000001F5C000-memory.dmp	purplefox_rootkit
behavioral2/memory/19984-39340-0x0000000000400000-0x0000000001F5C000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2564-13113-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/2564-26216-0x0000000000400000-0x0000000001F5C000-memory.dmp	family_gh0strat
behavioral2/memory/8816-26232-0x0000000000400000-0x0000000001F5C000-memory.dmp	family_gh0strat
behavioral2/memory/19984-39340-0x0000000000400000-0x0000000001F5C000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

LineAppMgr.exeLINE.exeLINE.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LineAppMgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LINE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	LINE.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LineAppMgr.exeLINE.exeLINE.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LineAppMgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	LINE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	LINE.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LineUpdater.exeLineLauncher.exe7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exeLineLauncher.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	LineUpdater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	LineLauncher.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	LineLauncher.exe

Executes dropped EXE 11 IoCs

Processes:

zubfsttg.exeLineInst.exeKbskb.exeLineInst_240625734.exeKbskb.exeLineAppMgr.exeLineLauncher.exeLINE.exeLineUpdater.exeLineLauncher.exeLINE.exe

pid	Process
2564	zubfsttg.exe
2640	LineInst.exe
8816	Kbskb.exe
8976	LineInst_240625734.exe
19984	Kbskb.exe
13996	LineAppMgr.exe
13368	LineLauncher.exe
13464	LINE.exe
9372	LineUpdater.exe
14464	LineLauncher.exe
14524	LINE.exe

Loads dropped DLL 58 IoCs

Processes:

LineInst_240625734.exeLineAppMgr.exeLINE.exeLINE.exe

pid	Process
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
13996	LineAppMgr.exe
13996	LineAppMgr.exe
13996	LineAppMgr.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
13464	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/13996-39509-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp	themida
behavioral2/files/0x000a000000023b98-39502.dat	themida
behavioral2/memory/13996-39511-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp	themida
behavioral2/memory/13996-39510-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp	themida
behavioral2/memory/13996-39515-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp	themida

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

LINE.exeLINE.exeLineAppMgr.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LINE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LINE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LineAppMgr.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Kbskb.exe

description	ioc	Process
File opened (read-only)	\??\U:	Kbskb.exe
File opened (read-only)	\??\I:	Kbskb.exe
File opened (read-only)	\??\N:	Kbskb.exe
File opened (read-only)	\??\V:	Kbskb.exe
File opened (read-only)	\??\W:	Kbskb.exe
File opened (read-only)	\??\Z:	Kbskb.exe
File opened (read-only)	\??\B:	Kbskb.exe
File opened (read-only)	\??\E:	Kbskb.exe
File opened (read-only)	\??\J:	Kbskb.exe
File opened (read-only)	\??\L:	Kbskb.exe
File opened (read-only)	\??\M:	Kbskb.exe
File opened (read-only)	\??\O:	Kbskb.exe
File opened (read-only)	\??\P:	Kbskb.exe
File opened (read-only)	\??\Q:	Kbskb.exe
File opened (read-only)	\??\G:	Kbskb.exe
File opened (read-only)	\??\H:	Kbskb.exe
File opened (read-only)	\??\X:	Kbskb.exe
File opened (read-only)	\??\Y:	Kbskb.exe
File opened (read-only)	\??\R:	Kbskb.exe
File opened (read-only)	\??\S:	Kbskb.exe
File opened (read-only)	\??\K:	Kbskb.exe
File opened (read-only)	\??\T:	Kbskb.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LINE.exeLINE.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	LINE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	LINE.exe

Drops file in System32 directory 2 IoCs

Processes:

zubfsttg.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Kbskb.exe	zubfsttg.exe
File opened for modification	C:\Windows\SysWOW64\Kbskb.exe	zubfsttg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 40 IoCs

Processes:

zubfsttg.exeKbskb.exeKbskb.exeLineAppMgr.exeLINE.exeLINE.exe

pid	Process
2564	zubfsttg.exe
2564	zubfsttg.exe
2564	zubfsttg.exe
2564	zubfsttg.exe
8816	Kbskb.exe
8816	Kbskb.exe
2564	zubfsttg.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
13996	LineAppMgr.exe
19984	Kbskb.exe
19984	Kbskb.exe
13464	LINE.exe
19984	Kbskb.exe
19984	Kbskb.exe
14524	LINE.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

zubfsttg.exeKbskb.exePING.EXELineUpdater.exeLineLauncher.exe7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exeLineInst.exeLineInst_240625734.exeKbskb.execmd.exeLineLauncher.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zubfsttg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbskb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineUpdater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineInst_240625734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kbskb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LineLauncher.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
19964	cmd.exe
21436	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Kbskb.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Kbskb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Kbskb.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

Processes:

LineLauncher.exeLineLauncher.exeLINE.exe

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LineLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LINE.exe = "11000"	LINE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\LineD.exe = "11000"	LINE.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

Kbskb.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	Kbskb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Kbskb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Kbskb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Kbskb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Kbskb.exe

Modifies registry class 27 IoCs

Processes:

LineInst_240625734.exeLINE.exeLINE.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\shell\open\	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell\	LineInst_240625734.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{A80ACA29-4544-48DC-A563-79862EB6AAE2}	LINE.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{C716269F-F721-4D41-B543-0E2F01E74747}	LINE.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\DefaultIcon	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\shell\open\command	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\ = "URL:LINE Protocol"	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\",0"	LineInst_240625734.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{49E2B209-BAEA-4BF5-85BB-F00D1458489F}	LINE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\",0"	LineInst_240625734.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{4F98D7E2-4C35-48F7-9621-ED972CB10A05}	LINE.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell\open\	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\URL Protocol	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\URL Protocol	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\ = "URL:LINE Protocol"	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\DefaultIcon	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\shell	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\shell\open	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell\open	LineInst_240625734.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell\open\command	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\line\shell\	LineInst_240625734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\lineb\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\LINE\\bin\\LineLauncher.exe\" \"%1\""	LINE.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
21436	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

LINE.exeLINE.exe

pid	Process
13464	LINE.exe
14524	LINE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

LineInst_240625734.exeKbskb.exe

pid	Process
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe
19984	Kbskb.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

zubfsttg.exeKbskb.exe

description	pid	Process
Token: SeIncBasePriorityPrivilege	2564	zubfsttg.exe
Token: 33	19984	Kbskb.exe
Token: SeIncBasePriorityPrivilege	19984	Kbskb.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

LineInst_240625734.exeLINE.exe

pid	Process
8976	LineInst_240625734.exe
8976	LineInst_240625734.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe

Suspicious use of SendNotifyMessage 5 IoCs

Processes:

LINE.exe

pid	Process
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe
14524	LINE.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

LINE.exeLINE.exe

pid	Process
13464	LINE.exe
14524	LINE.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exeLineInst.exezubfsttg.exeKbskb.execmd.exeLineInst_240625734.exeLineLauncher.exeLINE.exeLineUpdater.exeLineLauncher.exe

description	pid	Process	procid_target
PID 3876 wrote to memory of 2564	3876	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe	83
PID 3876 wrote to memory of 2564	3876	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe	83
PID 3876 wrote to memory of 2564	3876	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe	83
PID 3876 wrote to memory of 2640	3876	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe	86
PID 3876 wrote to memory of 2640	3876	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe	86
PID 3876 wrote to memory of 2640	3876	7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe	86
PID 2640 wrote to memory of 8976	2640	LineInst.exe	93
PID 2640 wrote to memory of 8976	2640	LineInst.exe	93
PID 2640 wrote to memory of 8976	2640	LineInst.exe	93
PID 2564 wrote to memory of 19964	2564	zubfsttg.exe	96
PID 2564 wrote to memory of 19964	2564	zubfsttg.exe	96
PID 2564 wrote to memory of 19964	2564	zubfsttg.exe	96
PID 8816 wrote to memory of 19984	8816	Kbskb.exe	97
PID 8816 wrote to memory of 19984	8816	Kbskb.exe	97
PID 8816 wrote to memory of 19984	8816	Kbskb.exe	97
PID 19964 wrote to memory of 21436	19964	cmd.exe	102
PID 19964 wrote to memory of 21436	19964	cmd.exe	102
PID 19964 wrote to memory of 21436	19964	cmd.exe	102
PID 8976 wrote to memory of 13996	8976	LineInst_240625734.exe	104
PID 8976 wrote to memory of 13996	8976	LineInst_240625734.exe	104
PID 2640 wrote to memory of 13368	2640	LineInst.exe	106
PID 2640 wrote to memory of 13368	2640	LineInst.exe	106
PID 2640 wrote to memory of 13368	2640	LineInst.exe	106
PID 13368 wrote to memory of 13464	13368	LineLauncher.exe	107
PID 13368 wrote to memory of 13464	13368	LineLauncher.exe	107
PID 13464 wrote to memory of 9372	13464	LINE.exe	109
PID 13464 wrote to memory of 9372	13464	LINE.exe	109
PID 13464 wrote to memory of 9372	13464	LINE.exe	109
PID 9372 wrote to memory of 14464	9372	LineUpdater.exe	110
PID 9372 wrote to memory of 14464	9372	LineUpdater.exe	110
PID 9372 wrote to memory of 14464	9372	LineUpdater.exe	110
PID 14464 wrote to memory of 14524	14464	LineLauncher.exe	111
PID 14464 wrote to memory of 14524	14464	LineLauncher.exe	111

C:\Users\Admin\AppData\Local\Temp\7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe
"C:\Users\Admin\AppData\Local\Temp\7979fef1fb127fc4dccd331b8081f9361ece01ae1768752abd07d9c668b26983.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\zubfsttg.exe
  "C:\Users\Admin\AppData\Local\Temp\zubfsttg.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\zubfsttg.exe > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:19964
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:21436
- C:\Users\Admin\AppData\Local\Temp\LineInst.exe
  "C:\Users\Admin\AppData\Local\Temp\LineInst.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Local\Temp\LineInst_240625734.exe
    C:\Users\Admin\AppData\Local\Temp\\LineInst_240625734.exe /M
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:8976
  - - C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LineAppMgr.exe
      "C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LineAppMgr.exe" -afterinstall
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:13996
- - C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
    C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:13368
  - - C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LINE.exe
      "C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LINE.exe" run -t 240662578
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      Checks system information in the registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:13464
    - - C:\Users\Admin\AppData\Local\LINE\bin\LineUpdater.exe
        
        C:\Users\Admin\AppData\Local/LINE//bin/LineUpdater.exe --deploy 9.4.3.3492 en-US real 0
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:9372
      - C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe
        
        "C:\Users\Admin\AppData\Local\LINE\bin\LineLauncher.exe" --updated 9.4.3.3492
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LINE.exe
        
        "C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LINE.exe" run --updated 9.4.3.3492 -t 240677171
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Checks system information in the registry
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:14524

C:\Windows\SysWOW64\Kbskb.exe
C:\Windows\SysWOW64\Kbskb.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8816
- C:\Windows\SysWOW64\Kbskb.exe
  C:\Windows\SysWOW64\Kbskb.exe -acsi
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:19984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Line.exe

Filesize
27.9MB

MD5
21a8a4c2011631c95cdd7266078ede92

SHA1
51779768fd4803e04350005e95095b0e680801e6

SHA256
7749fb86f511477700e1f24f5f203140a6448968f1ba596f196d5a4f973c8c3b

SHA512
5e13bd0d972297dac822f03846a62a9be0db04e3188c7671d77fd5d697304a915cf0ae6e2885c8e3df7ff41fb49a0eff5e0b59fed1c45a9f89a5257a4710940c

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LineAppMgr.exe

Filesize
3.4MB

MD5
33495e3353f37c817d334aee972265a6

SHA1
c66a9bb70e19ffcdc6ba0f3b27e0f4b1597e3352

SHA256
45a30aac523447c336100c6ba3fa159327dd7d715f057f2d5fbfeaebfba9a7b0

SHA512
72e43f26a220f351e00d563b8b8b082c385e2827beb9fd155cc39a6f85a33b762fd8ec7fb26d6aa08bbc8572372b7400709f3c822fa7391bfdd4ebce6c4dddf0

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LineLauncher.exe

Filesize
1.7MB

MD5
e5546909fafe737da0e5c293cdd1faae

SHA1
76869125cf990408dace3fdaf3e01d0c092f2234

SHA256
b2c3fada1bca7e6c59b8ce19a72289d92bf19f39c59b4e723b9e29fbde081c83

SHA512
f7255446ea2849e417d56a569ae2db4bc72970bd1d5fa8ae08fd5c5c87825595af1a2136858b19e987273a7b54edef0d50b5b4b5fdc2d992c12aba8ae59412b4

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LineUnInst.exe

Filesize
64KB

MD5
e6886fa66a25b039fcee482410aa047e

SHA1
7a3ea823a3014d7488691f7d3dfce3e4625e06cd

SHA256
d49a1d5fac1ac03bf380864b043284254d6c72c4dd63692d1664816332028803

SHA512
544d6bab9c1e650743118e1e0e1b3fabd37563bc2ac2931812b4cd8120d747cf6924aae80f99dfaec92927ae17bbc0c803220dd166947ecb01b25fc1512b0d69

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\LineUpdater.exe

Filesize
3.3MB

MD5
63320e5932bf42be3f8fff7ad42b380d

SHA1
b2d26137cfb3e4135cb0916ece3bbc075f51ead2

SHA256
869682f4f04a8b35e936e348058f0d36d6f0b1a4665751131554c2bc27549837

SHA512
09dadb46ce8544ccdb3b58c0b9b3043b73b0e386a6da6aaa3e957f0217f18b25f62412f44d6c7b933143655c522e6a8ca13eaddad088993510564d13ac7151e2

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Core.dll

Filesize
5.9MB

MD5
60a8a6e34370c1af4ab367943aad199c

SHA1
02d3135782ca730e6df5644ad4ee593c163b7108

SHA256
4ef7679d1e39decc581fc437e84883e3a2d2d905f16f8cc6dea23cbbd27e4fb3

SHA512
e5f00e07a2d49d2b847ffc5eb7fbea69120d9176b948d3122b0f4bdbde149deb2127f452639542acbe73345cb947bacec7ee192e8a1c1464fddbe2abc35ac81d

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Core5Compat.dll

Filesize
841KB

MD5
11ba6d7f1cc1e4ecb597957e9ac53cd4

SHA1
c50ad565db210b9ffa0661ec6db22bf53fb2560e

SHA256
a4f8a582243c9c0d5fe9b56e11c13af2101f30ddc804bc145d7c32dae964656a

SHA512
05a268b235aff79a90271e0b63a6074bba817f8937f6ff200f0864fa5de3a67db84e79b41780f41203ec31dd0db95645c235e80eacfff286e66537f169861e84

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Gui.dll

Filesize
8.1MB

MD5
c819e9a8180aa205d7e9334b7185dfb3

SHA1
ccf6f9604413c86f463da94e6bdfeeed89b096e0

SHA256
90c4e6763b7eccfaffa7b379f565c716d15c65acab115653b0669c0c62fa69ed

SHA512
0ad1bdbc258bfe1b3ef699c2add51174045c4082016395dc3eec6c8c2ebaf76ef591fb03287829440be8638959e14e985f6d318eefd6433895d87b55a29a6a2d

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Multimedia.dll

Filesize
843KB

MD5
e38e5145551653fcfd777376dcfa2f17

SHA1
22a3fde4950c353b5502df9f4d85a6c49379b7a8

SHA256
0bc58ced9791fa784ca7f99c80662b3ced2b38ba6f271380faa3869cd363caec

SHA512
1817f1898718ee5295394bda0fa99b2d088515de095b58b9bf90e2059c559eba1f15f0b780959849da68dd74dd3e20ce6cfa2917ee5b81983de490258e280468

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Network.dll

Filesize
1.4MB

MD5
93c3df6af78418a5e4dbfe5b1f96a3cf

SHA1
6a3ae57e2d4b219ec8169b1c9135e6c4c0ff299f

SHA256
142ab39d562c9b628b1e00476872adbced425615f41627440df70cffb7d1586c

SHA512
c8d0b0260546a4ad1b322c3141361b62a7c872829d0a7b60d47d795804e3d9ed7659ad319326ca0a8c9aa149bb434ed09a578534a090ac908188d3eecc04dd24

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6OpenGL.dll

Filesize
1.9MB

MD5
4e1e36a028d4444ec7edcd478cff9b71

SHA1
2c4ec7407bfc49fb17c75da54ba55e20b6b0f048

SHA256
4164818c2c9c3b3caf829e10965ac59b35df2a3e6768ee618b61b2c105ba6568

SHA512
5869fd0ef8ddd0dbf258edb2c409ccb4737545863be92ecfa60bcc87bfe5f8996a9cdba707c3bf95634a4fa2d30793d14f0801080aede551572048ee57a94440

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Qml.dll

Filesize
4.8MB

MD5
4cc2c8d0c34f7b0e27ddf0a7daa765cf

SHA1
3af834e15c8914ff328f546dc084aee0cead9a4a

SHA256
26ec81dc24df63f2d10e8594a1ca4ada435191e626bb228ab87fce95956d7fa4

SHA512
668215fda5682c722e8d4dbcf2d6883fbaee56cd45a0649e6cc3df3cb6733c93c796d4e46e8d1a35e80e9426f43bfc3bc2d7731d009138a7a276295d36344df7

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6QmlModels.dll

Filesize
703KB

MD5
a7f540118a901d5e7c4793591d6d49dd

SHA1
323d8b5bf2fe1b13fdb100625e32426b2829ed8a

SHA256
4a7a8c71c7569d44647115025a6ec0ca5da17e1ad4e16785fd9e90e6613385e3

SHA512
d12a67fcb5f3e47e3d146dffdc69671b08c0a98048f701ec9ab8538f6afad1906403ac11f18c695d63820e3d07526af63aa42e85012cd38bf11237f0b3e06913

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Quick.dll

Filesize
5.2MB

MD5
b18160fab782660143ec3d26cb9c5505

SHA1
9097aedfccceb4df00fbca0ff2307c444c5787a5

SHA256
73af1544069c86a61ce43ed35375516e14b66fbe8edfadc1aa6b4516bc1ae63a

SHA512
44464f6c0a9e2c0ad679be07e2fc2e3cd7da302ece17344626d7b90ae39dd07d87232bfbea1b191cd320fa4ec50d6958edb7fbd4df02869e3700641299fca141

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Svg.dll

Filesize
374KB

MD5
46f3f08961badbf146ecb79d8d4a1c40

SHA1
d8ee52e44aad5659cd072d0bcacd0739590a57b5

SHA256
832692e75e012f7276470c4e9ca3f7f6f3b1513b7d9eaa22fcfc7fa2cc1f5bd5

SHA512
376f23728331347ec72e50d67959a817bf59ca9f3ad88158a192700a2ec14c806091bceb87c7e255f3e95a9c96e4e535bac460f5d77081b023f72afe753cd030

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6TextToSpeech.dll

Filesize
131KB

MD5
c06baea212e14ad6c207dc4012123e1b

SHA1
626466c7464a63d8d67f5ec04dd3b4b907c1f14b

SHA256
f7cbe18b7bc0a6ef34244851c4342bb9e180f1fca9755ae7ab0cb12e3ded0271

SHA512
7385e7643d55fb220e69d06201889178fe0805ac9710ca4b4680ec41ce7ae7c12e7b6dd80132b596769c24d3ff43fd71b10e4b94a1f5d2c2e76edb5696dd824b

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\Qt6Widgets.dll

Filesize
6.1MB

MD5
f70a272bb7f9f5acd939003ea9c6e4bb

SHA1
4076aab2a1f085d5f914da65b815f63dd548a350

SHA256
58b1be150d3552bc1089833dd09ae8dd0be93708b8e29c7063ccced4606918f1

SHA512
7622b0ff6ce1c9c650dabb56075f299fe3dd9189fc2766ec6cd73d50a521f52a57a6df33870e4f9996ab5b0db9d5d19776a38d6e4d9230b8e0988c73f8ef5853

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\WebView2Loader.dll

Filesize
135KB

MD5
bceebc73cb9e3f239b99575c0d38951c

SHA1
d71033e74b44ae5584b6be1d4cc99e4094f5aadf

SHA256
f86b7be36295297de21bffccfde3cef776e175478592b4b16c3063b420723312

SHA512
2cac4b095a46ab625ba7e4c9297133df1ccf3e87eb45938fc65c3ffe6cac31204229f3f4cedc6e58244bf74c76fbe9f2fda7710c784c79814e5ee2ccfb1994e7

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\dbghelp.dll

Filesize
1006KB

MD5
623c9754952a35b018f2448af8184075

SHA1
c37c32c391c509d0bfc8522ac7018a3c4b2a1940

SHA256
f089f6b1aa2a324603728c0453568201cb0ab6b8d3e8d6dcc2b000ad5cdfaba4

SHA512
7f848c186962abe6d9db18406ecf26f824216ebf44a4972f1681ac89a4b793dcc43287d3d1bbe8d13079e80d4718ca59fec500c2dd8e5f17b61035fc0b2b3c43

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\libcrypto-1_1-x64.dll

Filesize
2.2MB

MD5
499b00969f10366c20455befbdba7ee4

SHA1
b5982e467bc86ec6c08fedf226cc3a170c69b2c8

SHA256
0a7c1c6eb8e6a43f50ca77d82cb5c9b69f6cc5067ad26dff0746fb0d7b264c6e

SHA512
76d14948bfe1df8f8d46d8d19175fd3b958e9e58fd29c2c3a9b30e7cade3a53f635afa26d6af23ff6b6448e58aa9eb391c6d03cc120fdf8790249d7bfe2c9f20

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\libnelo.dll

Filesize
2.4MB

MD5
26f0b7e341ad37698b0a599654d712d4

SHA1
febb65b3c72c8f43b31c519df109b4bdbfd7d19b

SHA256
833c50c991edb0018138fc9a56f36a8aa983895c5b263a385daed15a96133693

SHA512
f3bb408b1b91da57659f40e8563ff33ebf1cec0096bd96c9fb307afb2327a2585c45981fe702ca5791f753c53e6b368c3df6150c65fa8d0785d238cfcbdc6f14

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\libssl-1_1-x64.dll

Filesize
628KB

MD5
d00b6d9ca91b52a14bf3cf2425627f5a

SHA1
877c2f4f38b959947f4c4fd0f2962f34f0d23318

SHA256
292abfab8416177b7cd4d6aa903a60a2fb060725928290ca63a6183eec992832

SHA512
496a052a74ebb09766d014daa3eac949111d805e2d58702e8e0d6c437f0820a26e2ba3e4a8e3ca31f5292f36a08827821a80e3d63101e43b57bd4ab6fdbecdd2

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\msvcp140.dll

Filesize
566KB

MD5
a62a22c33ed01a2cf362d3890ffa70e1

SHA1
ea3f55d92cdcb788876d689d394ec3225b1d222c

SHA256
003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89

SHA512
7da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\skottie.dll

Filesize
5.4MB

MD5
bba6138ee66f8f507458c431aaadd8a1

SHA1
eef717bc0bcfaea4f64049f7ef1be4914f72b9e2

SHA256
a00ad855491e56bd5ddcf42ecd6d7b2a8d42b7200ef4fae5875db85687561f04

SHA512
9a07bbdce579c5285c1ad29ad2ec04e9fb57d74f234527c284d17d96e61fc770889ab32b27020f9c7378588994dd8e88278a2b15497a4af99570d8f22632074d

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\vcruntime140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\LINE\bin\9.4.3.3492\vcruntime140_1.dll

Filesize
48KB

MD5
7e668ab8a78bd0118b94978d154c85bc

SHA1
dbac42a02a8d50639805174afd21d45f3c56e3a0

SHA256
e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f

SHA512
72bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032

Download Submit
C:\Users\Admin\AppData\Local\Temp\GFAJsGoCfpj5IVsr.exe

Filesize
4.5MB

MD5
8bcca35447a5d6740d82e71a8fe3f23c

SHA1
843c326a617b37f8d6409146e7e0fe9f0869ac0e

SHA256
5a8ff2bcdc03b385af4b63c6316ebc89042b641137dc6a72e4ca41653a64dd75

SHA512
03df9ea8de1eebe43366393f5e463fce1137686ce5e9512c53e8977db83ca763d9d4645c140e025b51112a6d21c20d622bdbf45d1a4dd93dd9297fad51fd028a

Download Submit
C:\Users\Admin\AppData\Local\Temp\LineInst.exe

Filesize
1004KB

MD5
587e3bc21efaf428c87331decc9bfeb3

SHA1
a5b8ebeab4e3968673a61a95350b7f0bf60d7459

SHA256
b931c5686cc09b2183bba197dc151b8e95ca6151e39fb98954352340c0b31120

SHA512
ffae2dab5caf16dc7dfd0a97a8ff6349a466bc57ee043d1ac4d53e011498e39b9a855295d10207ba578c6857abebd445d378e83aa2ff6ec247713d81b370d0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaDFA4.tmp\System.dll

Filesize
11KB

MD5
d77839cc52a47e2db7d7fb944643fb0a

SHA1
ed3cd493e5a465a143862df3f280e936f3bd2fac

SHA256
93b73294a24201a4299fd0da7e0ab0dbffa130da300cc3a2c80d2aa7f2da7c77

SHA512
76f2739990bfae391f8c4c7346487150fa70eca82a15adff14e84d83ca03af5b202b8abab139f56b59dffd942a26aacdb359548367be7f80ff6bbf28b973e77e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaDFA4.tmp\UserInfo.dll

Filesize
4KB

MD5
6461ba2b54c2239503eff55de913c437

SHA1
7796499cc23eee4c522be381987913e6c5e8826e

SHA256
4658e40d14895f792cb5ea8bbee7dc95a6bff6478f8e41c3732a66b92fccc0d5

SHA512
12ae466bc824d57d8e44b5a2dca395b98f002fe3cfe4ed544939d7ce5480b174934adf4e9e06ea9d6907e64e180f1b1b6f9d25d607713ca23bb090f1cf3379cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsaDFA4.tmp\killProc.dll

Filesize
89KB

MD5
b9edf77857f539db509c59673523150a

SHA1
23276a59846d61d0a1826ba3b3f3c4b47b257f20

SHA256
62f8e07d3ba5e9e57aaf529786a92931098f6ee33c6ab5057be5ad4ee0545b31

SHA512
8bedf1ffd4d5f1853e1794e32b7ff482c3c207a8d6600a54d9f0c583feac8711ac70c985f4579a947ee3c686e179dcdf42752bb45da2a5b9254f372265a92f79

Download Submit
C:\Users\Admin\AppData\Local\Temp\zubfsttg.exe

Filesize
27.4MB

MD5
f86698c77feaa537e043c6b7cd196367

SHA1
0e0b994ad8015f913347d2777f56d0de756c2563

SHA256
fe8c3aa2b4383bc06e24fb05795e171963da0f1160369ab0feb400be177bbfca

SHA512
236e482845313044259064de02a7509c7d53581ac234225b043574e0586d96782e21c01675cefae33b389aba188dfb4760c4b2622085e44bd45797ff3bcb4fb0

Download Submit
memory/2564-13113-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/2564-13109-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-13111-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-13108-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-13112-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-37-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-13107-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-13106-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/2564-38-0x0000000076430000-0x0000000076645000-memory.dmp

Filesize
2.1MB

Download
memory/2564-3912-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/2564-5921-0x0000000076F60000-0x0000000076FDA000-memory.dmp

Filesize
488KB

Download
memory/2564-26216-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-26215-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-26232-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-26220-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-19010-0x0000000076F60000-0x0000000076FDA000-memory.dmp

Filesize
488KB

Download
memory/8816-17001-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/8816-26218-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-13124-0x0000000076430000-0x0000000076645000-memory.dmp

Filesize
2.1MB

Download
memory/8816-26217-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-26221-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/8816-26222-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/13464-39569-0x00007FFB401C0000-0x00007FFB40701000-memory.dmp

Filesize
5.3MB

Download
memory/13464-39576-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13464-39578-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13464-39570-0x00007FFB3F230000-0x00007FFB3F841000-memory.dmp

Filesize
6.1MB

Download
memory/13464-39577-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13464-39575-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13464-39574-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13464-39573-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13464-39572-0x00007FF627EB0000-0x00007FF62CBBC000-memory.dmp

Filesize
77.0MB

Download
memory/13996-39510-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp

Filesize
9.1MB

Download
memory/13996-39509-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp

Filesize
9.1MB

Download
memory/13996-39515-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp

Filesize
9.1MB

Download
memory/13996-39511-0x00007FF6B18F0000-0x00007FF6B2211000-memory.dmp

Filesize
9.1MB

Download
memory/19984-30108-0x0000000076730000-0x00000000768D0000-memory.dmp

Filesize
1.6MB

Download
memory/19984-39307-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-39304-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-39340-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-39303-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-26233-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-39305-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-39302-0x0000000000400000-0x0000000001F5C000-memory.dmp

Filesize
27.4MB

Download
memory/19984-32117-0x0000000076F60000-0x0000000076FDA000-memory.dmp

Filesize
488KB

Download
memory/19984-26234-0x0000000076430000-0x0000000076645000-memory.dmp

Filesize
2.1MB

Download