a45fbd8344906368ad2132ad2afd176d6c482d69f1f44ed0406ba13980c7121e

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/10/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
liner.exe
Size 233.4MB
Sample261020-vrlpvsty6q
SHA256 a45fbd8344906368ad2132ad2afd176d6c482d69f1f44ed0406ba13980c7121e
MD5 da599facc362961576d6007f7c6b65aa
SHA1 fd0cdf2937de404074d5cee53fb7ab86cab20c25
SHA512 e6e6ab37213e883d93930c8eea092aa4d09ef55de83ef50403a906986b2f90ccf3a5782eedcef2852dba5c7026def89894ba3f3cf716f690ecfbb2fddc48c01d
SSDEEP 1572864:i/NyAGH4hD79pOCV35G0WQYIaCOdfN5yhYF2BFbJxgYAN19ImU4Hmij+knS2H4gK:UNyAGCYCfg65VD
TLSH
T143C88C03E29641D9C09DC1794B5A9633FE71B8054B24A3DF2B9447962F76EF82B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	liner.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	liner.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	liner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	liner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	liner.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	liner.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	liner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	liner.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner\shell	liner.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner\shell\open	liner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\liner.exe\" \"%1\""	liner.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{AE986B27-7445-4AEC-B102-F737EC1AEFA8}	liner.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner	liner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner\URL Protocol	liner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner\ = "URL:liner"	liner.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\liner\shell\open\command	liner.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4856	liner.exe
4856	liner.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe
Token: SeShutdownPrivilege	5800	liner.exe
Token: SeCreatePagefilePrivilege	5800	liner.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 5624	5800	liner.exe	87
PID 5800 wrote to memory of 1480	5800	liner.exe	88
PID 5800 wrote to memory of 3948	5800	liner.exe	89
PID 5800 wrote to memory of 4848	5800	liner.exe	92
PID 5800 wrote to memory of 2328	5800	liner.exe	93
PID 5800 wrote to memory of 5920	5800	liner.exe	94
PID 5800 wrote to memory of 4856	5800	liner.exe	104

C:\Users\Admin\AppData\Local\Temp\liner.exe
"C:\Users\Admin\AppData\Local\Temp\liner.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=gpu-process --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAACCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5624
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-http2 --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=560373778 --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2300 /prefetch:1
  2⤵
  PID:3948
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --launch-time-ticks=562270847 --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4848
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --disable-http2 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2328
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --disable-http2 --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:5920
- C:\Users\Admin\AppData\Local\Temp\liner.exe
  "C:\Users\Admin\AppData\Local\Temp\liner.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --enable-gpu-rasterization --user-data-dir="C:\Users\Admin\AppData\Roaming\@liner/client" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAGAAQAAAAAAAAAABAAAAAAAAADgAAAAAAAAAAAAAAAAAAADCAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAADAAAAAEAAAAAAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=1960,i,9212101069318223413,9657056137880414839,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1968,i,15146418045910330057,11181000465903646625,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x150
1⤵
PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_0

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\data_0
Size 44KB
SHA256 d9d67e960cc9cd696c0de15affe5db4a44538a72b4f9ea386d7b840d979f60c6
MD5 fc715fe04f065ac2e683448b16a68173
SHA1 c235789ba631b4c9adef87a3bd1b2d071c064b24
SHA512 d78b8ca7e5807000c09967a7752a890f705005864e76049bdf74b875df7b76d137aab1c08a00232e881f572461f6ad4075e75f9a681b88f2dee0a632a7f855af
SSDEEP 3:MsFlthltllKlll9Qvxikfl4iwuQV6ZOyrxXSdxjkFbOqkXZDE0vz/:/FsFQvxikN4vQMYxCDYFqqY64/
TLSH
T1F3138CBCBA802E67C6824C7C20ABEFBC0232C4A7808202470024F020BC8D3C61C2C2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\data_1
Size 264KB
SHA256 4bcdab151c4cfe57863241dbbdb38a49e8ec673e61d1796e073e7f086618fc7e
MD5 1020606ad1f2c9755fdb8b2e80782068
SHA1 26a8735b1a55852ab248b1993e7c1ca74c8d5616
SHA512 008651b3783eb6175af6e7280763de70ea8730645c9cdf320ce65a3a21a39ba26ce02f4042270b595a99cffa8bbf96f8d3e422d84da1b46b7a3173efc82992e1
SSDEEP 48:o89ZkBNehV1lCp1CpShq8rVRsXtzlCMc/xgK+vhwEQCG8:o89mvm1gDHe9zlfP7a
TLSH
T1F9444C42804F2EE7CA70847E621BF73DF5A3144356E84B79326F01C5A19F222D801EE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 c55c1e052175c36c9a88084498b59db061529c5480bf22d89dfe4141ecc499fb
MD5 abe2b9defc5346a8aa22cf9ba8f897e5
SHA1 230f1275c0770852ac56682826b4edf9ab5f343e
SHA512 0f924536a5a12fbaeae8c5893f82da6ad0b97783c207bdfcc6e30c865f62a7434253aa71e2ae785b835257feada8797ec687fcdcfcf439ed5ddcfd3a162c6260
SSDEEP 192:YpjdEYN19ek6WkjCMaeZtRymuu4gkH/ylJzNr+Fq+rZkps6ay4H:WWYD9aOGAmuuZr+FMDa
TLSH
T142250ACAAB64B193C7A3C9B1F8C0C93D6DF41289BA9390D2604182F668C5B860F5755E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\f_000001
Size 20KB
SHA256 1b4ec6ca99bb1a7aa129cefa90657beb5a1cd811ba39418e3b1fff07993a986e
MD5 d7dfd37902154ddc498fc12d2fdba4b6
SHA1 464418e952150180bf890e691322c9fb6ad548d2
SHA512 24c926ba093f076265a3646cf94bd73509bc215701a3c3f1758851da20027c0cacc9927db79fb23b13cedf234aabb5384ca6fb62586fba65b4999cf0068cb7df
SSDEEP 384:JkMm3dE+uHcDluqszNir+7/RFQLHd4iOaFlU0IWKx0Q:JkMkuHcZkNir6/4LHd1OGlZIfr
TLSH
T13492D0530D065DBCC64CF61FE6FC572FED78D63780AB974D2082F59ACB421822B8295A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\f_000002
Size 71KB
SHA256 2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
MD5 4b73e2ff3024784eca66d2120a9bcb22
SHA1 2870bcb8ece10145e089262bb6634d18ac85bec6
SHA512 9ebe0b2cc7ed7298d931fc246732ed90881f0252b957afbf14f390c75c1da3fddf1b3fbb00be8d489cbb7b5a18f9dbda17a24e18594d44ebba4b7ca3f50bb10a
SSDEEP 1536:MO6PxhqwEppt5fUo8w4d+X5JlhLzcua67BYePELa:M3qh7VdDf8GPH
TLSH
T1F0630245820BA35EE09D4A79D27481F61FC2CB5C2BBF5C27538289AB5F57DBF6410134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\Cache_Data\index
Size 256KB
SHA256 fa82bcb4f9b5f517e044af3cd9d5293452eeaa6567197b0b5c0abc9f1334f464
MD5 53ad957f9a8014d08cc83289e80df6c4
SHA1 6edd5f817467ae3c8f4ea42326c91570d01fd7c2
SHA512 e3c7dfc15e9341450e9dfa3b33151826f6a3e5fb8fc12a3a52f6e6f63926cb28f1f0bc5cac5aa0bc37ecf4d8417362fd20a86457c391410cb90cd774554b6cda
SSDEEP 3:LsYllFlklNllklkXl6gHAllLll/nv/olXlJlmNtl:Lsx3lPzHSwaN
TLSH
T1E644022AC3950D06DED502BC854787259338D4C6CB8F834743680A143CC9BC05F0E084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

journal.baj

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\No_Vary_Search\journal.baj
Size 4B
SHA256 9c169428d852e25bd59b27652ed533d2a1f09f96e4c329fa5e06f47e16731543
MD5 11daac1cffa071d4e1ffddcb865aa73a
SHA1 321585a6f7e4b50cac5d72b4baf5535e68d77201
SHA512 f49ad8c3924eed37210d68e06dd9b2292356ce21aa8eebc34395af54cebc0155657394e0e012824ce716449fc9bf4412aba1c2cb2917d56f1523ec7af3f0e373
MD5 SHA1 SHA512

Submit Download

snapshot.baf

Path C:\Users\Admin\AppData\Roaming\@liner\client\Cache\No_Vary_Search\snapshot.baf
Size 20B
SHA256 0c2dd377ed0cc66161e9db8f89f7d8bcb3ad8c06c4a054bdcba214ab05f58c9a
MD5 7177cd1b3e21f48a23cb47dc11b36f7b
SHA1 9e1086a6c2296b41c004834f7521790bb2941d67
SHA512 e7e8b2204e455f6e7fa5a2239cbb4c0c506562d30184fb07d63f8544cd0249226bd3d7d399ef0b69774e72afe100f9858da527b0e15a7bd3c35782d7513eff23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\@liner\client\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\@liner\client\Code Cache\wasm\index-dir\temp-index
Size 48B
SHA256 d279eb9201b98d1042cb446ef88e1bb036902fa6aeaddae812714c702c5de00e
MD5 fdcff3f4d48baeac73814f2f6f10e20f
SHA1 d6ab26b7bafe2362e7b4261c85c6442e47f24336
SHA512 58727428da58708f91ba73cb835ea6e91727ecdfcda200f882257c64ec0fdd943f109fa5c2a1d1318c28854f778c83c47b7582756b21c68864a1dba4b5e07ba5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\@liner\client\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\@liner\client\IndexedDB\file__0.indexeddb.leveldb\LOG
Size 287B
SHA256 8a204c22698155753bf36c441969b3e4d5abc597e298d076afe8f1b59045aff1
MD5 3b0c110e31a76992ba649c4220874766
SHA1 7977b16531935fdadac14601a1c5697314d5a882
SHA512 c347c753cd2aaab066472e968155879360f5ae13e26ea00c63a3e175da9cde848009247c98d905d19a518861454914a3a251e23cd5d5425bcb9be7fe40819a04
TLSH
T126D0C21884C8C73FE50AC2934938F7099BB67B05AB887C8CCF90E2A8AD85404C76E101
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\@liner\client\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\@liner\client\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\@liner\client\Local Storage\leveldb\LOG
Size 259B
SHA256 17edb30d1f2b8856f403b1efd918bb796dbdb83d1fcb51987b8589ded686502e
MD5 6ec4830e25bb52b9cec9dfa84fb03f83
SHA1 e98ee3cb37c8ca9a4093e8669037e977be66f72d
SHA512 ce6472c20b5570c83fdabdb3dba7245f40f9b6a79198a0a5796fc0d4ef5b7148627151671229e2ad7d4b46bc9b026ac8bd3b1c875e3f8ce71eed192884bee2d2
TLSH
T15ED05B6544D9C62D9745C297963EF30CDB7072016F897A0DDFE5E68DF948408D551083
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\@liner\client\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent Statef6782ff8-21c9-49a4-bda1-4956b1e81765.tmp

Path C:\Users\Admin\AppData\Roaming\@liner\client\Network\Network Persistent Statef6782ff8-21c9-49a4-bda1-4956b1e81765.tmp
Size 797B
SHA256 f435d959fbb9b62a73c00d6736b23b6072bc011ef97cde4431b3b5ce0e1b3506
MD5 8c02c85686ba41db47e3577d833ce4b9
SHA1 2c5077971c55e5422767c06d420fcd546ed3b0df
SHA512 6b3d693ddd43a98928c6491cc8ac89a3598584aea8fa688f2be54768b515c672a0a1f22e8d5530d8ac899a63eacba7f753024d8a948e5da99bf0fa874047fa23
TLSH
T1BC018597C2C8867E499227F52A397523C1AF4D1952243D47CDE8DB8F43E55790A0068E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\@liner\client\Preferences
Size 132B
SHA256 f846122f609034026aef27e202ed044d5a06924336d598706e7c55dbea216d13
MD5 3300d3c6af5879d72467996cce94e81c
SHA1 ed37c150527024c9ea1f4e5133c4cc7e2d6af125
SHA512 7995d56f84dcb3c0216907f1650d4750be62dc80bf30b44b2622fc45df7cc0619bb827a1fce8be81475df237f6797e85fbac95a08f669e2431b747790e1f1c8a
TLSH
T186C02B03611021BE4D2FED5580851885C9E105500C0F5C8188C43204291611C144B02F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences79f1bddf-b158-4e10-9138-6e194e5cebfc.tmp

Path C:\Users\Admin\AppData\Roaming\@liner\client\Preferences79f1bddf-b158-4e10-9138-6e194e5cebfc.tmp
Size 57B
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a
TLSH
T101900297652634755E1F1D65400B889B5CF905704E0B5E0641D032969A2A45D088705F
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\@liner\client\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

archive.tar.gz

Path C:\Users\Admin\AppData\Roaming\@liner\client\bundles\temp-0.1.40-1792517788413\archive.tar.gz
Size 3.6MB
SHA256 7696f9a9f4b1ea9b9b1b385b6e92bce596af57c127f6a6c22df4bad0b71503b8
MD5 bd6bd3bc447a4cb1fdcf8ff439cdfe3e
SHA1 aec033bf40e725b82838a40135efec89f281829f
SHA512 dccfd0a3e8cd31977bef6a0b45b78cc9e09d76b083c3be76caa51466f2c8be3a897fc05b0e2ff2814336d96ab9d89eaaab96d332fa485777b1164439c251c529
SSDEEP 98304:p+3mi0tKJfYblcrBoFX1XRvsq6g/ubAcoL+BE:Q3mEYJcrEFFsq6Jy+S
TLSH
T18F0633857997BE553E591D6B0C3A4C151E79FAA1FA4869CB32DFB7C70682B2F02B010C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/3948-27-0x00007FFC46970000-0x00007FFC46971000-memory.dmp

Download

memory/3948-28-0x00007FFC45FF0000-0x00007FFC45FF1000-memory.dmp

Download

memory/4856-219-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-216-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-220-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-208-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-218-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-217-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-215-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-214-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-209-0x000001715D730000-0x000001715D731000-memory.dmp

Download

memory/4856-210-0x000001715D730000-0x000001715D731000-memory.dmp

Download