Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/10/2026, 17:13

General

  • Target
    Liner-Setup-0.1.40.exe
  • Size 146.2MB
  • Sample261020-vrlpvsty6q
  • SHA256 a0e5bd93f06acae675004a6293c01c3fa3a5b127e59fcdf0bb4b1209351bc76d
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 16 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Liner-Setup-0.1.40.exe
    "C:\Users\Admin\AppData\Local\Temp\Liner-Setup-0.1.40.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
      2⤵
      • Hide Artifacts: Ignore Process Interrupts
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3716
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\liner', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5100
  • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
    "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
      "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe" --type=gpu-process --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1996,i,5252376937217526966,13349475679586426820,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2000,i,7157108374178453517,785512301556243299,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1992 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2888
    • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
      "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-http2 --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --field-trial-handle=1996,i,5252376937217526966,13349475679586426820,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2000,i,7157108374178453517,785512301556243299,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2196 /prefetch:3
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:4356
    • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
      "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --app-path="C:\Users\Admin\AppData\Local\Programs\liner\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=603275151 --field-trial-handle=1996,i,5252376937217526966,13349475679586426820,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2000,i,7157108374178453517,785512301556243299,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2400 /prefetch:1
      2⤵
      • Executes dropped EXE
      PID:1132
    • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
      "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --app-path="C:\Users\Admin\AppData\Local\Programs\liner\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=607842694 --field-trial-handle=1996,i,5252376937217526966,13349475679586426820,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2000,i,7157108374178453517,785512301556243299,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2780 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4352
    • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
      "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --disable-http2 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --field-trial-handle=1996,i,5252376937217526966,13349475679586426820,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2000,i,7157108374178453517,785512301556243299,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3796 /prefetch:8
      2⤵
      • Executes dropped EXE
      PID:2740
    • C:\Users\Admin\AppData\Local\Programs\liner\liner.exe
      "C:\Users\Admin\AppData\Local\Programs\liner\liner.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --disable-http2 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --field-trial-handle=1996,i,5252376937217526966,13349475679586426820,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2000,i,7157108374178453517,785512301556243299,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3836 /prefetch:8
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:1836
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x508 0x50c
    1⤵
      PID:1852

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log

          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
          • MD5 SHA1 SHA512 TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 13a18ecaf58d1273cf90ce5fb0f6f04fc956398cf9c46e4b9476cda85e9ea5c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StartupProfileData-NonInteractive

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 39fffcba9b201e019782209ec876e575cc77d48436cb711d017660f25b0e90c3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE.electron.txt

          • Path C:\Users\Admin\AppData\Local\Programs\liner\LICENSE.electron.txt
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Programs\liner\LICENSES.chromium.html
          • Size 19.5MB
          • SHA256 f2310820377f4d8f2a5f6bc8744b985d6772cef9ee7d8d197b01fdb330db0bb8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\chrome_200_percent.pak
          • Size 1.2MB
          • SHA256 30fa4a6e27c9ff2fb0f939f01158477e621a67d86e9ecb84cf11b3947db8eb9d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Programs\liner\d3dcompiler_47.dll
          • Size 4.5MB
          • SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxcompiler.dll

          • Path C:\Users\Admin\AppData\Local\Programs\liner\dxcompiler.dll
          • Size 24.6MB
          • SHA256 494a0ca088d1b9dd8ff673d590aaddd6bdcff09c938befef8c88c2016c49ee9a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          dxil.dll

          • Path C:\Users\Admin\AppData\Local\Programs\liner\dxil.dll
          • Size 1.4MB
          • SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Programs\liner\ffmpeg.dll
          • Size 3.0MB
          • SHA256 0b4a5071d9cee1c8318f365d977f271ce771be8cce214cd12e24b714e239ff16
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Programs\liner\icudtl.dat
          • Size 10.4MB
          • SHA256 9f48c7f9c7c94d516a14870707e910ab94d75ae640ff6842c4af53276cd26ebe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\af.pak
          • Size 621KB
          • SHA256 3017b141bd16e24190d810f0748612f0fd4352ca8553002b9a63a7f77f7154f8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\am.pak
          • Size 1005KB
          • SHA256 67b938d162bc75db067120bb8366b5bafd9a75fa99a0ca9ad4f46b47d1d37634
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ar.pak
          • Size 1.1MB
          • SHA256 10b104b02b795bc3c83a83664f77c31e5a44dcb3b581b7ed5e68e40362171e08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\bg.pak
          • Size 1.1MB
          • SHA256 2eb9c74c67e4b13b45a73061fa978738e335bc245da71bab0ea9b205fe91074e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\bn.pak
          • Size 1.4MB
          • SHA256 415621a5c0b1546e6e447d43b76414425a8703cc7681d637ec1f283ad0c787e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ca.pak
          • Size 700KB
          • SHA256 0271debd0cda19a4757ab3c8c6de8d8c741f1c60a54642c3ee480c38ba9fcd98
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\cs.pak
          • Size 725KB
          • SHA256 799a789ce531991cb975425730db310f9a8fe74091eee568f3e65fcc7ef0cd57
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\da.pak
          • Size 650KB
          • SHA256 260783e1c13d3187c9e42b6aa4b5e996a3731393b15a57b6f673ec1a22768444
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\de.pak
          • Size 701KB
          • SHA256 ca51f2179e75a391634a010f31897ef233b752c15db75e258203809a543c3cda
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\el.pak
          • Size 1.2MB
          • SHA256 37d2e1ef69fea9bdb1e0902cbc61a458baa9009fc3761029bd1c1882a7a0c9b2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\en-GB.pak
          • Size 566KB
          • SHA256 01d9200a5daee1770f7147b166d25baa6a8dd72c138c3c526421e656dec789f5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\en-US.pak
          • Size 572KB
          • SHA256 23b271e8009bfa14783700cd0712b4ecaa5b8f2ea28a4d81ae1d7e05bc0c96b1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\es-419.pak
          • Size 691KB
          • SHA256 5e59d63a7a73f79ab85e62fd79cd8d9cdb9b5b9a9b4dbcb1a96279ce65ee626e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\es.pak
          • Size 687KB
          • SHA256 5b110026a9f491fa4816e91145ac8855527277ce716b5dec41765baaadf7f83d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\et.pak
          • Size 627KB
          • SHA256 dd1205eae606f12510e24ce39f301439c98b3293d766ca5839dc292a14d7973c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\fa.pak
          • Size 1.0MB
          • SHA256 1bd4994b710c80d4658ec469a8f3cc12b08615774d39951cf13d284f6ed8b5f5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\fi.pak
          • Size 639KB
          • SHA256 1f3123d7fb5c22a95b5250ea17450b665c3c6cd6a6dfd28bbdde15e1bf684a0e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\fil.pak
          • Size 724KB
          • SHA256 8af47a96f25daa5c2bb0936358289ece0c6424359f5c83c644c40412e11b402f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\fr.pak
          • Size 745KB
          • SHA256 317b707e2dfba4044ab58f74fe53c8a0d447770f6633f251ccd0eb97e00b38c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\gu.pak
          • Size 1.4MB
          • SHA256 e86e8c240d4b6283abb03c49df9e8899607ef9def6d4933c7a541d63b5835271
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\he.pak
          • Size 907KB
          • SHA256 1534938c992c1386785b91ce46941adde7c9ff3638dedb574eaf044ca439c963
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\hi.pak
          • Size 1.5MB
          • SHA256 10a6f19c1982590e33476427dee8d4293b0707e25dc536d6394b5782ecc3b642
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\hr.pak
          • Size 698KB
          • SHA256 d46c64ae8af3562e37eb80438aa2bee228fafda251d58ba4d0991291f1c72aab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\hu.pak
          • Size 747KB
          • SHA256 0a46fc8d50f74effd1cfe1979e677df3de6fc47e6b551267303d93d57bd83f50
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\id.pak
          • Size 620KB
          • SHA256 4474c516e9ebe29a340d2d80cb37bc3074ab163c1ae90f084a0b7b02a4f30117
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\it.pak
          • Size 677KB
          • SHA256 078eba5ec8d7d0a5ae3178a33b0f5b6e27c354ce8416d2e554f0092085180446
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ja.pak
          • Size 822KB
          • SHA256 5f54ceffa5f846ce707d6ea816032d1407175bb56e1cc76dc2d139fd941bcf6b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\kn.pak
          • Size 1.6MB
          • SHA256 af5fed2130102ecc0c878059c88faed9d6db2e8b147fb5ae9e15e3fe69706c8a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ko.pak
          • Size 701KB
          • SHA256 158d98626e06a615f166463392821bdda325c5f86f0d0cabc422f4ff0a1627df
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\lt.pak
          • Size 759KB
          • SHA256 af969f4407c190dd01a426fa1244cb1ec7cdf2909d1c3ba5b87ff662ba567303
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\lv.pak
          • Size 756KB
          • SHA256 27e20dfa5585161ef8b641f628aefe6c88d9f9590ffedb647e0c9da1cacf219d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ml.pak
          • Size 1.7MB
          • SHA256 b5606265910e45098a88e989202a550531f6d00333c6b112ed4c5cbc07b2ff6a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\mr.pak
          • Size 1.4MB
          • SHA256 8465d4077ed5414cbcb7d9bdb00d85e515a1a069703cdc1d4d67c9d6e5623fb0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ms.pak
          • Size 652KB
          • SHA256 af7021a00befa586aa067ae3ccb339079e6f13ee0cab1621836f6abb608b6f2a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\nb.pak
          • Size 623KB
          • SHA256 fcaa70d6dd3e8205118d6c2aa3bf7c5f0fad06838151fc6d590328100103b00a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\nl.pak
          • Size 649KB
          • SHA256 7a9a05304d6806b6b23ddc3e1c6ae1bafebb1a5dd7f15034ae86cab5330349ee
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\pl.pak
          • Size 724KB
          • SHA256 e30f8d353234bb4642402ec2b0c226d75ef1d2b90e03931f04eb7815b44dc7c3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\pt-BR.pak
          • Size 680KB
          • SHA256 04b104298da6c847b321f36ad6f3340d16f9636b3cc9f9c6f49dfcd43545cca5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\pt-PT.pak
          • Size 684KB
          • SHA256 bdfa7264dddf70f936f1785737969559a577b51d1952c820a468c611d18b17ca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ro.pak
          • Size 711KB
          • SHA256 1e6b5b0dac63a9e951daf523de310f6bd9e5c53e281f37706d41bd35d2a08bb5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ru.pak
          • Size 1.1MB
          • SHA256 52a31a7ca057b8c76208620932120927a089502ddfb66c30de4324959f9e0075
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\sk.pak
          • Size 737KB
          • SHA256 a53551e8d251fa01305afe1d0d187144c56bfdffd5d1aa9f96a9350b96c0a252
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\sl.pak
          • Size 705KB
          • SHA256 e1371c8df577b979e3a515af34b0aaa3d07153c7a5c55d39a9b49a7ffe62d3d2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\sr.pak
          • Size 1.1MB
          • SHA256 be4ce17afac24dffc1eb36609cb51e766e77097d6656b1008a2a825e59609cc1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\sv.pak
          • Size 631KB
          • SHA256 8bdff8855d23c739ece357f653c0a17bb36fe97577a5761912080d057ed341a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\sw.pak
          • Size 669KB
          • SHA256 312b225a81cc3cc15f13f80c45dd0e0bb3655d31873d2956861207e70c33c1dc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ta.pak
          • Size 1.7MB
          • SHA256 91fb1460711df108d8d435a378c8be1d1e80b0886c0158d8c6ae92f35812681b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\te.pak
          • Size 1.6MB
          • SHA256 fc8c2706c5dfd36e7af8e380a240e0f697cc5fe969b512092a2185896512c4af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\th.pak
          • Size 1.3MB
          • SHA256 6552b5d1f190e3340b19e6f25858afff1d0afc5c28bb1650093d1198db862954
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\tr.pak
          • Size 681KB
          • SHA256 0045a91695ecf866895a0b2624081e00c365416a989e8a3c2d0c8f4478cbc4b8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\uk.pak
          • Size 1.2MB
          • SHA256 4bcf16ea2f89250a83a580b65aa12b25f7f528d33a75a2d3b94140bb732a7e9e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\ur.pak
          • Size 1023KB
          • SHA256 c218e21744df2ff0669a87d497d65d76333073577360d4c662c592de146bf82a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\vi.pak
          • Size 810KB
          • SHA256 6e3c4c5338f14644961b2277f880474c6d21f5338e592f156ae7fadfba560209
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\zh-CN.pak
          • Size 578KB
          • SHA256 96bfac1181a719dfdf381174e8cca6365f140d356ab9330cb549a9b36ff964db
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\locales\zh-TW.pak
          • Size 570KB
          • SHA256 5a4aedbb70d21be261a5732660654c4b49d9477ebc698154089150eb708dbe2a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Programs\liner\resources.pak
          • Size 11.9MB
          • SHA256 c981108783cb7f15dcb4a8e94536d27791df70040344750684615c5beb954098
          • MD5 SHA1 SHA512 SSDEEP TLSH

          elevate.exe

          • Path C:\Users\Admin\AppData\Local\Programs\liner\resources\elevate.exe
          • Size 105KB
          • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Programs\liner\v8_context_snapshot.bin
          • Size 724KB
          • SHA256 5a4d92091bb4e7979b43802ddd70f7b775a6edc8d93a78de33fa47a17ddbfc8f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Programs\liner\vk_swiftshader.dll
          • Size 5.3MB
          • SHA256 a3239fabefee509d40221a55d0bb1711746f59c9b620ffdb34335b450592acbb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Programs\liner\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Programs\liner\vulkan-1.dll
          • Size 917KB
          • SHA256 f3b192d1df5dc8d046c84d6e15bc575c9f6605fe0497b126d8b6664a9a75032f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          __PSScriptPolicyTest_oh1zqwoy.x2d.ps1

          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oh1zqwoy.x2d.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\7z-out\chrome_100_percent.pak
          • Size 702KB
          • SHA256 ab7c4b7b6cb8832a31d44b95ec50ce52294f49422a3bdde4e21968eca2930cbe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          app-update.yml

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\7z-out\resources\app-update.yml
          • Size 91B
          • SHA256 a6f8199130feeb8c72b741f69cc461011f18d9442f94d9f78d4c6f175fab60e7
          • MD5 SHA1 SHA512 TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\7z-out\snapshot_blob.bin
          • Size 360KB
          • SHA256 3b44e8f5e909ca00da26c051791dcd5f57fd7ae36ec58ccf3ea9242f4f6ca98f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          StdUtils.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\StdUtils.dll
          • Size 100KB
          • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\System.dll
          • Size 12KB
          • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UAC.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\UAC.dll
          • Size 14KB
          • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
          • MD5 SHA1 SHA512 SSDEEP TLSH

          WinShell.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\WinShell.dll
          • Size 3KB
          • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
          • MD5 SHA1 SHA512 TLSH

          nsDialogs.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsExec.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\nsExec.dll
          • Size 6KB
          • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\nskDD2D.tmp\nsis7z.dll
          • Size 424KB
          • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
          • MD5 SHA1 SHA512 SSDEEP TLSH

          data_0

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\data_0
          • Size 44KB
          • SHA256 0bf7bd0e8306cdb03c417e3f1d887902c03a212fd93d1592e9c869512b9a8ec9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          data_1

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\data_1
          • Size 264KB
          • SHA256 de88f950fbdf36f07118fc0322121f634bc2bcf0d26f5ffcba4ea5dab053954d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          data_2

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\data_2
          • Size 1.0MB
          • SHA256 b325ddd04ab90e1503a8c3faeaaee6b3e025b6d0392e5033a8f9bc3ae034119b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000001

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\f_000001
          • Size 20KB
          • SHA256 1b4ec6ca99bb1a7aa129cefa90657beb5a1cd811ba39418e3b1fff07993a986e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          f_000002

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\f_000002
          • Size 71KB
          • SHA256 2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          index

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\index
          • Size 256KB
          • SHA256 3857eebcab1b953259a21a8b1ab1830b9b52ed0991de9680a68a0e906d16aa85
          • MD5 SHA1 SHA512 SSDEEP TLSH

          journal.baj

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\No_Vary_Search\journal.baj
          • Size 4B
          • SHA256 9c169428d852e25bd59b27652ed533d2a1f09f96e4c329fa5e06f47e16731543
          • MD5 SHA1 SHA512

          snapshot.baf

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\No_Vary_Search\snapshot.baf
          • Size 20B
          • SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
          • MD5 SHA1 SHA512

          index

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Code Cache\js\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512

          temp-index

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Code Cache\js\index-dir\temp-index
          • Size 48B
          • SHA256 ddf1841151c9c8f6ff892bc77cb6c323011847ae19b25ee747526d9657ab4f0b
          • MD5 SHA1 SHA512

          data_0

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_0
          • Size 8KB
          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
          • MD5 SHA1 SHA512 SSDEEP

          data_1

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_1
          • Size 264KB
          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
          • MD5 SHA1 SHA512 SSDEEP

          data_2

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_2
          • Size 8KB
          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
          • MD5 SHA1 SHA512 SSDEEP

          data_3

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_3
          • Size 8KB
          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
          • MD5 SHA1 SHA512 SSDEEP

          MANIFEST-000001

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001
          • Size 23B
          • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
          • MD5 SHA1 SHA512

          CURRENT

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512

          Network Persistent State

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Network\Network Persistent State
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          Network Persistent State78b19ae8-15d3-4aa9-a7a4-4a2fa1a06adb.tmp

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Network\Network Persistent State78b19ae8-15d3-4aa9-a7a4-4a2fa1a06adb.tmp
          • Size 797B
          • SHA256 6ef102b94382e9005f52ab431ef1cf100f3505eed02f015967c4af27516a4571
          • MD5 SHA1 SHA512 TLSH

          Preferences

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Preferences
          • Size 132B
          • SHA256 aa7fc0dfa9642125c4a00a86e791ab142f10051f58f79d6ae2668d11f822c0eb
          • MD5 SHA1 SHA512 TLSH

          Preferences8c12bd76-bc93-4cd3-8cbe-28a2278e8143.tmp

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Preferences8c12bd76-bc93-4cd3-8cbe-28a2278e8143.tmp
          • Size 57B
          • SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
          • MD5 SHA1 SHA512 TLSH

          MANIFEST-000001

          • Path C:\Users\Admin\AppData\Roaming\@liner\client\Session Storage\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512

          default.dic

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          memory/1132-786-0x000001B7A49C0000-0x000001B7A49C1000-memory.dmp

          memory/1132-784-0x00007FFB84FC0000-0x00007FFB84FC1000-memory.dmp

          memory/1132-836-0x000001B7A4990000-0x000001B7A49BB000-memory.dmp

          memory/2888-940-0x0000022D68BB0000-0x0000022D6A448000-memory.dmp

          memory/2888-951-0x0000022D68BB0000-0x0000022D6A448000-memory.dmp

          memory/3716-24-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

          memory/3716-51-0x0000000006620000-0x000000000663E000-memory.dmp

          memory/3716-23-0x0000000004A80000-0x0000000004AB6000-memory.dmp

          memory/3716-25-0x0000000005120000-0x0000000005748000-memory.dmp

          memory/3716-26-0x0000000005090000-0x00000000050B2000-memory.dmp

          memory/3716-27-0x0000000005980000-0x00000000059E6000-memory.dmp

          memory/3716-28-0x0000000005A60000-0x0000000005AC6000-memory.dmp

          memory/3716-36-0x0000000005AD0000-0x0000000005E24000-memory.dmp

          memory/3716-37-0x0000000006040000-0x000000000605E000-memory.dmp

          memory/3716-38-0x0000000006070000-0x00000000060BC000-memory.dmp

          memory/3716-39-0x000000007F9F0000-0x000000007FA00000-memory.dmp

          memory/3716-40-0x0000000007000000-0x0000000007032000-memory.dmp

          memory/3716-41-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

          memory/3716-43-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

          memory/3716-42-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

          memory/3716-22-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

          memory/3716-52-0x0000000007240000-0x00000000072E3000-memory.dmp

          memory/3716-53-0x00000000079E0000-0x000000000805A000-memory.dmp

          memory/3716-54-0x0000000007390000-0x00000000073AA000-memory.dmp

          memory/3716-55-0x0000000007400000-0x000000000740A000-memory.dmp

          memory/3716-56-0x0000000007580000-0x00000000075AA000-memory.dmp

          memory/3716-57-0x00000000075B0000-0x00000000075D4000-memory.dmp

          memory/3716-58-0x000000006FE30000-0x0000000070184000-memory.dmp

          memory/5100-96-0x0000000005900000-0x0000000005C54000-memory.dmp

          memory/5100-99-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

          memory/5100-107-0x000000006F820000-0x000000006FB74000-memory.dmp

          memory/5116-66-0x0000000005560000-0x0000000005570000-memory.dmp

          memory/5116-65-0x0000000005560000-0x0000000005570000-memory.dmp

          memory/5116-74-0x0000000006500000-0x0000000006854000-memory.dmp

          memory/5116-76-0x000000006F6B0000-0x000000006F6FC000-memory.dmp

          memory/5116-84-0x0000000007F00000-0x0000000007F96000-memory.dmp

          memory/5116-85-0x0000000007E70000-0x0000000007E81000-memory.dmp