e412ea16866eceba1d3a8d283dedc793c402a34f5b1100ad6ded510136e0668d

Analysis

user interaction
yes
max time kernel
809s
max time network
428s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shift_Setup (3).exe
Size 441.0MB
Sample260511-1kvbbaaz5w
SHA256 e412ea16866eceba1d3a8d283dedc793c402a34f5b1100ad6ded510136e0668d
MD5 4161035654b40fa1e2f994ac42001233
SHA1 a685073163001f07e2da5bd23feed4a3a8de02fd
SHA512 bc493980c8a1fb611fb8f11409879ed342c995c26a12edede3829fe35649ec820b9ffed066e322eaf9db4bc3fa18da9e9d4ab24e87c3428176c339ef594578ad
SSDEEP 12582912:G0zh22RxOzYpwfTLOdygeFgRPjq627JbZeRYw:G0z42XpwXMyg+8rP21In
TLSH
T15B29331BFA467A3CD2AB09BCE53AA55DAA7B05005422CC53C1EEE5CD872D1F2092F747
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 21 IoCs

pid	Process
4836	Shift_Setup (3).tmp
2464	Shift.exe
1384	Shift.exe
1288	Shift.exe
4300	Shift.exe
2504	Shift.exe
3984	Shift.exe
4420	Shift.exe
5024	Shift.exe
2076	Shift.exe
376	Shift.exe
2612	Shift.exe
5440	Shift.exe
1436	Shift.exe
2744	Shift.exe
1704	Shift.exe
4652	Shift.exe
4484	Shift.exe
5840	Shift.exe
1716	Shift.exe
4976	Shift.exe

Loads dropped DLL 64 IoCs

pid	Process
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
2464	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1384	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
1288	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
4300	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
2504	Shift.exe
3984	Shift.exe
3984	Shift.exe
3984	Shift.exe
3984	Shift.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	Shift_Setup (3).tmp
File opened (read-only)	\??\R:	Shift_Setup (3).tmp
File opened (read-only)	\??\T:	Shift_Setup (3).tmp
File opened (read-only)	\??\V:	Shift_Setup (3).tmp
File opened (read-only)	\??\A:	Shift_Setup (3).tmp
File opened (read-only)	\??\B:	Shift_Setup (3).tmp
File opened (read-only)	\??\G:	Shift_Setup (3).tmp
File opened (read-only)	\??\K:	Shift_Setup (3).tmp
File opened (read-only)	\??\N:	Shift_Setup (3).tmp
File opened (read-only)	\??\X:	Shift_Setup (3).tmp
File opened (read-only)	\??\Z:	Shift_Setup (3).tmp
File opened (read-only)	\??\E:	Shift_Setup (3).tmp
File opened (read-only)	\??\J:	Shift_Setup (3).tmp
File opened (read-only)	\??\M:	Shift_Setup (3).tmp
File opened (read-only)	\??\Q:	Shift_Setup (3).tmp
File opened (read-only)	\??\S:	Shift_Setup (3).tmp
File opened (read-only)	\??\U:	Shift_Setup (3).tmp
File opened (read-only)	\??\O:	Shift_Setup (3).tmp
File opened (read-only)	\??\H:	Shift_Setup (3).tmp
File opened (read-only)	\??\I:	Shift_Setup (3).tmp
File opened (read-only)	\??\L:	Shift_Setup (3).tmp
File opened (read-only)	\??\W:	Shift_Setup (3).tmp
File opened (read-only)	\??\Y:	Shift_Setup (3).tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift_Setup (3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift_Setup (3).tmp

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	chrome.exe
4776	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/1712-1-0x0000000000CC0000-0x0000000000DA9000-memory.dmp	innosetup
behavioral1/memory/1712-6-0x0000000000CC0000-0x0000000000DA9000-memory.dmp	innosetup
behavioral1/memory/1712-11217-0x0000000000CC0000-0x0000000000DA9000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230097143466484"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000016a3561c7e91dc01853becc98391dc01f69deec98391dc0114000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000ce40541c7e91dc018672a5818491dc01a5781a0d90e1dc0114000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe

Suspicious behavior: AddClipboardFormatListener 20 IoCs

pid	Process
2464	Shift.exe
1384	Shift.exe
1288	Shift.exe
4300	Shift.exe
2504	Shift.exe
3984	Shift.exe
4420	Shift.exe
5024	Shift.exe
2076	Shift.exe
376	Shift.exe
2612	Shift.exe
5440	Shift.exe
1436	Shift.exe
2744	Shift.exe
1704	Shift.exe
4652	Shift.exe
4484	Shift.exe
5840	Shift.exe
1716	Shift.exe
4976	Shift.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
4836	Shift_Setup (3).tmp
5908	taskmgr.exe
3680	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe
5144	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5908	taskmgr.exe
Token: SeSystemProfilePrivilege	5908	taskmgr.exe
Token: SeCreateGlobalPrivilege	5908	taskmgr.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe
Token: SeCreatePagefilePrivilege	5028	chrome.exe
Token: SeShutdownPrivilege	5028	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4836	Shift_Setup (3).tmp
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5908	taskmgr.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe
5028	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe
3680	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4836	1712	Shift_Setup (3).exe	83
PID 4836 wrote to memory of 2464	4836	Shift_Setup (3).tmp	95
PID 5028 wrote to memory of 4960	5028	chrome.exe	162
PID 5028 wrote to memory of 4448	5028	chrome.exe	163
PID 5028 wrote to memory of 4448	5028	chrome.exe	163
PID 5028 wrote to memory of 4552	5028	chrome.exe	164
PID 5028 wrote to memory of 5116	5028	chrome.exe	165
PID 5028 wrote to memory of 5116	5028	chrome.exe	165
PID 5028 wrote to memory of 5816	5028	chrome.exe	167
PID 5028 wrote to memory of 5816	5028	chrome.exe	167
PID 5028 wrote to memory of 1936	5028	chrome.exe	168
PID 5028 wrote to memory of 1936	5028	chrome.exe	168
PID 5028 wrote to memory of 3648	5028	chrome.exe	169
PID 5028 wrote to memory of 3648	5028	chrome.exe	169
PID 5028 wrote to memory of 3188	5028	chrome.exe	170
PID 5028 wrote to memory of 3188	5028	chrome.exe	170
PID 5028 wrote to memory of 5520	5028	chrome.exe	171
PID 5028 wrote to memory of 2128	5028	chrome.exe	175
PID 5028 wrote to memory of 216	5028	chrome.exe	176
PID 5028 wrote to memory of 2808	5028	chrome.exe	177
PID 5028 wrote to memory of 3032	5028	chrome.exe	178
PID 5028 wrote to memory of 3032	5028	chrome.exe	178
PID 5144 wrote to memory of 5944	5144	chrome.exe	180
PID 5144 wrote to memory of 1496	5144	chrome.exe	181
PID 5144 wrote to memory of 4776	5144	chrome.exe	182
PID 5144 wrote to memory of 1496	5144	chrome.exe	181
PID 5144 wrote to memory of 3328	5144	chrome.exe	184
PID 5144 wrote to memory of 3328	5144	chrome.exe	184
PID 5144 wrote to memory of 5684	5144	chrome.exe	185
PID 5144 wrote to memory of 5684	5144	chrome.exe	185
PID 5144 wrote to memory of 1124	5144	chrome.exe	186
PID 5144 wrote to memory of 1124	5144	chrome.exe	186
PID 5144 wrote to memory of 3320	5144	chrome.exe	187
PID 5144 wrote to memory of 3320	5144	chrome.exe	187
PID 5144 wrote to memory of 376	5144	chrome.exe	188
PID 5144 wrote to memory of 3792	5144	chrome.exe	189
PID 5144 wrote to memory of 3792	5144	chrome.exe	189
PID 5144 wrote to memory of 4844	5144	chrome.exe	190
PID 5144 wrote to memory of 4844	5144	chrome.exe	190
PID 5144 wrote to memory of 3164	5144	chrome.exe	191
PID 5144 wrote to memory of 3164	5144	chrome.exe	191
PID 5144 wrote to memory of 3680	5144	chrome.exe	192
PID 5144 wrote to memory of 3020	5144	chrome.exe	194
PID 5144 wrote to memory of 3020	5144	chrome.exe	194
PID 5144 wrote to memory of 4788	5144	chrome.exe	195
PID 5144 wrote to memory of 1660	5144	chrome.exe	196
PID 5144 wrote to memory of 1992	5144	chrome.exe	197
PID 5144 wrote to memory of 3952	5144	chrome.exe	198
PID 5144 wrote to memory of 3952	5144	chrome.exe	198
PID 5144 wrote to memory of 4204	5144	chrome.exe	199
PID 5144 wrote to memory of 4204	5144	chrome.exe	199
PID 5144 wrote to memory of 5700	5144	chrome.exe	200
PID 5144 wrote to memory of 5700	5144	chrome.exe	200
PID 5144 wrote to memory of 3916	5144	chrome.exe	201
PID 5144 wrote to memory of 3916	5144	chrome.exe	201
PID 5144 wrote to memory of 4980	5144	chrome.exe	202
PID 5144 wrote to memory of 4980	5144	chrome.exe	202
PID 5144 wrote to memory of 5704	5144	chrome.exe	205

C:\Users\Admin\AppData\Local\Temp\Shift_Setup (3).exe
"C:\Users\Admin\AppData\Local\Temp\Shift_Setup (3).exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\is-3GI9PCDADK.tmp\Shift_Setup (3).tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3GI9PCDADK.tmp\Shift_Setup (3).tmp" /SL5="$6023E,460918416,893952,C:\Users\Admin\AppData\Local\Temp\Shift_Setup (3).exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Shift\Shift.exe
    "C:\Shift\Shift.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: AddClipboardFormatListener
    PID:2464

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:1384

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5908

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:1288

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:4300

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:2504

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
PID:3984

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:4420

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:5024

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2076

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:376

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2612

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:5440

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1436

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:2744

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1704

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:4652

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:4484

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:5840

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:1716

C:\Shift\Shift.exe
"C:\Shift\Shift.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
PID:4976

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc3eb9c728,0x7ffc3eb9c734,0x7ffc3eb9c740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,11307363919355670518,17666602375049840945,262144 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,8499311574344518677,294430342310148105,524288 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2400,i,10439677018587422380,17346525642052218823,524288 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,4446115752203833573,9061620829107850310,2097152 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,16650510446947699724,10911795146760348104,2097152 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4476,i,7242129010327884120,16379000387395572262,2097152 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,12545364562968348468,15161788124728201557,2097152 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,2158864753199271179,6703547498391946472,524288 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,11587744109773543041,5239548825907939296,524288 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,13702234767303319881,5396170208320120477,524288 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,1366471487478910254,1494641577473400458,524288 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4604,i,6873362926035326407,12387748346809671911,2097152 --field-trial-handle=1960,i,2646707785922774064,2138925235636131505,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc3eb9c728,0x7ffc3eb9c734,0x7ffc3eb9c740
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,2181140494403686356,10477780199815360257,262144 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,5027480265365736095,3637968321369836943,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,1333484702636142719,12858548765390868800,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,7895665374834015792,3064686959455222193,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3152,i,8078073382936671576,2645909760174895018,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4396,i,1080125882421426648,5808310894753215897,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5284,i,222400334262253461,7063568379839646999,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5300,i,13261469917630197862,3268188327634017232,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4400,i,6713263646113937189,11774996894062566796,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3256,i,2220330596094916502,11017083153095816663,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3424,i,5310330436486647524,18173870927482212862,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3156,i,4066866711658155601,475075286635344719,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3216 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3328,i,14354372722106149212,3088305457039159967,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,1829471609530408722,8723691404056436433,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3332,i,6944534900716769360,12617276917100073611,524288 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3924,i,13233700898889289419,12130540010780259259,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4620,i,10205644452921428556,16809621715072465904,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6004,i,3166135556334932102,908720027081740484,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5912,i,3794226385612901566,14220199290860420139,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3896,i,5011505057696327747,13506049204718490679,2097152 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4528,i,9731036961242208754,11362026257630594135,262144 --field-trial-handle=2052,i,17463697083567438152,412744861304697665,262144 --variations-seed-version=20260511-090056.053000-production --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:5704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4632

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Qt6Core.dll

Path C:\Shift\Qt6Core.dll
Size 5.8MB
SHA256 f0ccc66f9496c6ad1075fc08466bb0ccd7b9f3ee014292dd5036c8fcc2018e72
MD5 96960fb6d837c99adf1d60ced65188e2
SHA1 c78102a5af8930637e2d5db9d0cb266d170ab159
SHA512 46f776a32bc97f8bf95fe230d3571bc438b6a96bf990f55df6c24b558409d2070e496d402d3c4eba905b6c99d4ef8b8b33e0d4b7f2213bbea2989de6e0012fe7
SSDEEP 98304:WhWbW1bkIeu8q9tpKFdu9CwJsv6t+JG/3X:uXpKFdu9CwJsv6t+Y/3X
TLSH
T189567D1762F60095D8FAC139CB5B9603EBB278154321ABEF01A466196F73BF5193F328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Gui.dll

Path C:\Shift\Qt6Gui.dll
Size 8.8MB
SHA256 7bf2863d491430da8d08e396f6b255afd7696166697b5d089137bc63cb46faac
MD5 ed7751b773b9064edbadd261936c3e4c
SHA1 9ae5291942e45698b0bb4bfc98efacd18877bf80
SHA512 6c152a41e132579b6638435dcb5837ae1113eb88d5fca9b07cca393b0bb0d26e92ba25c5860f062a995b84d9caa11d8eb70e009b162ba0b44d99f5d2e0fc5d09
SSDEEP 98304:o76EDXaVcB0KE9a2MUXKKE3uA9jOREz+72cY:ek00KEVFXKKYW7M
TLSH
T103969E57A2EA11D9C57BD13C8B5B9517E7B270050322DBEB02A08A592F33BF16A7F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Network.dll

Path C:\Shift\Qt6Network.dll
Size 1.7MB
SHA256 6da1755bf7ffeef5d42da0a0b7b32d088b5b947288698a9e19f90faf218918b8
MD5 961d809618d67a7ab3282fccb934bce5
SHA1 021dfa08944271c1dfcad6411f08323c4ac8916c
SHA512 13527c22f58bd808ec67e296d45d3672ab7412bd5395fcbc0881a1d8ab4d1eb7dc4e89e86b352aefe748eef5b76ee33dab3e879fc258f0459e0d89cffed3f6e8
SSDEEP 24576:5fVj9becG6dtACoau5WGqDkuvbZxylwrWL915lpljVVl:59j9becPtYaucGqDkS6llpL
TLSH
T113856C57A3E44296D86EC139C74B8A0BFA72700453669BDF42658F152F73BE21B3E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Svg.dll

Path C:\Shift\Qt6Svg.dll
Size 503KB
SHA256 1228eb1cd6bce4b0c1703b1e2dad4c4cfe814f4f0d4c92e5a78010c4e45dcada
MD5 9c0f9bbadbd94c224b46979a0a1af70c
SHA1 c38d1085a1190a35e55212f47f8f927139b9ca4d
SHA512 8bf3ab05f0fea716d87a7027d65dc3acc913d38e7c8b73b56caef832092acd1f796da201f3a2cbe819b36828abf969dccc6c9cc58cacd7fde18747e255974bc8
SSDEEP 6144:P3hdrthZ/gOCEeHbTtU9nLIc6QkcaKhAeacqrwjh4s7ZAwg4ClAPKvlrFaB:7r9/jCPb29nEc4caKieacgOgFaB
TLSH
T132B46D67F3A20286E46FD13CCA6B8816E7B370041392D7EF41658E542F237E16A7E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt6Widgets.dll

Path C:\Shift\Qt6Widgets.dll
Size 6.2MB
SHA256 413b6fee48a2a6c7b864057ce172308189a8a4e74642a03dbf7a64d0e7548e7c
MD5 8803d0678108f47324b2ecb7151db985
SHA1 2be071b4027d224c899a4952fe2efa7eae637227
SHA512 09ca694703d98a51c86ae713e2f4e11782bbb90054a36599b6295c1f91b35906b3dfae8f251ebedb4cdbb8914a3352ff73124fbc205bd26fe088096d3e71ea20
SSDEEP 98304:wYzxCqFXsBKcrrtp6jg0rhtaasJ0hSy2q:wYzxCqFXh4Rp6jg0rhtvEC8q
TLSH
T1FB667B5777EA0185C9ABD23DCB5B8A07EAB2B04443229BCF11658E152F737E12E7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shift.exe

Path C:\Shift\Shift.exe
Size 2.0MB
SHA256 82930d944c6efcb52119096681fba26691244467ef838a2090ccdb3d8a60252b
MD5 a3346e188d019fab72e9249abb0842c8
SHA1 ff81e79b49a871c78ec9828eea26f62afa8320ab
SHA512 9c00e8f31d5af59394415dd4a2aa462696629dea32359fce9afd6645893d8268f957a67c8cd7e6a9eefeca3936ce0ba89ee94bc05f274d92cdcab2027357e803
SSDEEP 49152:QbUgnLkthSqOlXt18TA83oiIaEAvJ7SWJRObKcmdN0KKc:cZBeR7vRWKFzK
TLSH
T196A5D03BA76901F8E1FAC37ECB478903D6B2380903729AEB03915A551F676E85E3D705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvgicon.dll

Path C:\Shift\iconengines\qsvgicon.dll
Size 76KB
SHA256 bc2193ee257c345d1c31133bae4d27b7a3df0137275d32bafdcfb51cd9c79358
MD5 2383a4113857e6b42c1c83b4d61e1c02
SHA1 7379ae1fde4989ecba24465f178f6876c1ae05e5
SHA512 8829120e5acab5a76e2c3d1de870b243dd390758d8c2d7d5cce02891450b339847945618936744afa7ec93a13087eb99f3da920d265c3dee6a19c1696c82a750
SSDEEP 1536:h36D4u/Lxye8AlGr/HAltgy3/gmKUR9zu1bGY41jxWdmgZgKxngGzl:d6DXdft9JKURtu1bGYixWdmgmKHl
TLSH
T189735B532BA92219DC5AC93DC327C647EE7AF1107362ABDF125144326E237C16EB5B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Shift\imageformats\qgif.dll
Size 46KB
SHA256 ed0e28a910d0e03073da287ed33cae5a7d06cb6f82cb5bf9df5adf49d6ae6894
MD5 b5a9bc1c735289e55750ba1c2b5094c6
SHA1 0a26690e59efbd9953e95a22a276f054d31b7b32
SHA512 1bedafbbc5367683334156f8f11abd3ac7eeb8d4de8d1ac2f0405adb3c362895f53a6b77ec42003f6d0f0435c12197df9721e464ab9c63725ff3d9d5cc429836
SSDEEP 768:abTuQPwX6wCIohpGt0U5DnEZZ3CfUFEXW9bcgKxnVbGYJdEZNhX:mTuQPtwXozLUaZ3CfUFEXW9bcgKxngGA
TLSH
T170237C465BB541E4E1E7C238D1878A2BDBB5B670A743CBEF0011857D1E633E13A38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Shift\imageformats\qico.dll
Size 45KB
SHA256 a58f59a6b7f95c3902f738e56e8f72fc72fb48cf76d220e97dd067dbcf2d3199
MD5 a22216c967a04aedc2c3fecbab279eeb
SHA1 f4ef832a1d33a82c6246d660af53c5ad1ace3be9
SHA512 8988b9b6b56642e06b65313d9507913f86e89288f1e8edb709fab0f3eb0dbd50aab8111ab02560caadaf73d6c49085d8639bee016332303937552dff82042dbf
SSDEEP 768:nnYTPBPUkJ4R6tTpS/u2NwyEXhdu8qzugKxnVbGYJdW0lNW:AP9UkJntkW2NwyEXhdu8qzugKxngGTq
TLSH
T15D237D9AA37902D1F5AAC63895478B23DE71F160B713CBDF0222456A1E333E27E38755
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Shift\imageformats\qjpeg.dll
Size 560KB
SHA256 2863940aba4c0e4908d3893d7d8b0ffa43539d1ed463fd5b7f6bc62b04282f8c
MD5 d7d47d716f51459b215270b9ee2e5b42
SHA1 3c3a88601f80ebadad496547598bc8c77affb5cd
SHA512 1a2e9f7b9fa4b551a1ec46ac4b924942ed0b932d0a65555d9b0f8875f9c66e4a5eae3869d73e7df542cbcf17135e8b0df3ccf37263f9bc557d0a6ea003e7c3f2
SSDEEP 6144:T+mVmz0nDiUQ1n+6Iq39kifk61daofCGzs+C9crsbc4SFSkG0wWTh/EDh5r3Sw1h:TgnkSFSGgK1BxgyM
TLSH
T14DC42942F6B51841C7E68838DF5AC956DB91781D03F68AF7B1D1CBE53B1BAA07A36300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Shift\imageformats\qsvg.dll
Size 38KB
SHA256 0af40394be65d34e8853ecc1d0a829c083378f3b3bdfaa3f143b3f4abf1951cb
MD5 350f4ad25ef27352e37219de4435e42f
SHA1 a2b49d1907aafc3ed7bb2b5f1091191c5f8f9071
SHA512 981bcc5a21b77ba13901886949ea7c6830dbdbbfb79e606be79d32f04f2c5aad0c562bba396e8f45d6e62ed76fcc900f06358f3619c9dde25621675dfa505c21
SSDEEP 768:pfVYvNicMKbxPemMwQWIQgKxnVbGYJ956N0:E1ic1xmmMwQWIQgKxngG9
TLSH
T1CB038D0B9B6A49A2F0BAC63895878B27D932F160A38397CF1162427D5D733D17C7C35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Shift\platforms\qwindows.dll
Size 889KB
SHA256 eeecf7a66e66fe8c846f6b4f541ceb9f4e643699cae4ff565240bced693da19d
MD5 1bb5c96d5b48058fa0ef19e0156f9661
SHA1 32d2ff54afbb19762e4e4ce0fcc3c1258108c71d
SHA512 da58a419ea533fa5369d84b2b69ccba3f1b962ba2e3561ce465d2f438b65631aa1d9952137b20fb1ceef3b3a39074e5932f39d8d3eafcf41f7eb26c967a233bb
SSDEEP 12288:JsmILQifd3Sn984F+zSTe1yQ1+hp1RkB1vcOmjNgt+J:cQSd3E98u+zSTe1N1+X1ezv2RJ
TLSH
T167154B17A7A40285D47FC13D878B8A13EBB2701213A2DBCB4161C9597F377F22A79B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startup.log

Path C:\Shift\startup.log
Size 399B
SHA256 c3c59ce2f0c4fd2fe8707f5fb77af2a7ccfa58a0bc810b57e56166dfacd6c5a0
MD5 a62cf22417608f14f0bdd6d2b2362533
SHA1 2e1044a04556c11d9efbaa83f3564a29f30a24e2
SHA512 e66b2ac172e60215c98112e320e710fd51b9af74286d3131d9ea6eddd20d84aaf159bf988081daebb84f55f2dc41d5cd8be6d8f924bc273f5e90e14fca3a24e5
TLSH
T1C5E0EDEF49F8908118910412CB66DB56AF1E7602E5EC2088FF32C5081A8D42C5F5E92C
MD5 SHA1 SHA512 TLSH

Submit Download

startup.log

Path C:\Shift\startup.log
Size 713B
SHA256 458d6a273739f9658436cc83d88874d0ec951940c30663964859c5908f74202c
MD5 17cbf7b2d4e42ed95fcb1059d392a4f0
SHA1 1bb8d97fe0ac87b2160eb0f17c2c37ec69893a93
SHA512 19a7730a0590c9c3ab0ada91a563b036ff129f3bb6884928008f9442c7921bbd836342bcad79d641b35645f8bb56a19e7485d02b04c5def1da4a207f14bcde5c
TLSH
T13E014FEF8DF8808118D51413C7A6DB096F1EB602E5EC2088FF32C6081A8C42C9F5E93C
MD5 SHA1 SHA512 TLSH

Submit Download

startup.log

Path C:\Shift\startup.log
Size 4KB
SHA256 97d1b5bf1153057ec70236d3dd4a68700ce1d725087a3e568c2c947a78360380
MD5 81a8c6d992381ee37f2361c40be6842e
SHA1 b141f86c020ffceaad9f1af63305894635018826
SHA512 9ff4dee5592cb02198f427fdbdeb14b7fb526da466b79af4d147bf40448a73d63dff480799239c898bf350ba27044ce8488f42a58cd1c2f1912b2d7cdd6c9a1f
SSDEEP 96:K1Fa/MMM5IrvuNAY3pYiMGkM/qfczfWmez/ILC/ILC/ELmDELmDELIRkZSRkZSRZ:MnDrS0O11RdTllT
TLSH
T1DC9124EF8DF6C48118855453C3A7EB061A1A7A42F5FD309ABF32C50C1AC84285F6E53C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qmodernwindowsstyle.dll

Path C:\Shift\styles\qmodernwindowsstyle.dll
Size 207KB
SHA256 35c0cba7e7a5ed5b8d7cfa6c9fb9b78aa9e7cb2d3c92c5cf8a3548a835b84e11
MD5 0ef9514ff7a1442a97ed61362c421374
SHA1 9d1bc320cb3d996b980503db053240fb0eeeb5a7
SHA512 f488829383ad52d067bafce4eb3cb02087fb1705289f1e1f0f37ac816ca8e307a9ff397f8fa33d7450b26678cfec90c8fae2cee49efae3ce79ca911d2e541bfb
SSDEEP 6144:nyKjHTcpL6KuNR/MCB30bQFHSuFJaGQNgYR7Q:nnj4pLgNFMPQ
TLSH
T11B24380333A613D6C567D2B8C52F1613F573706413229AEF0066CAB42F672E3BE7AA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Shift\zlib1.dll
Size 88KB
SHA256 9d79b6986a615689e40e8ad9c95a3e3fe906f641551c1e353d0547bdf526b6f5
MD5 0ad639ad0da326a91e0a71700bef5f1e
SHA1 e8f363b1be9647fa59a19cfbe4dbc2f4c127105c
SHA512 aaa63898c1c445b7592e0f850e6eab914c491012c5c70021260c14ed5d761751ae2930fd496b52b080054dda64de3e0f5be38f89268db264c5fb1d51f5106783
SSDEEP 1536:nvUiKm+qRDDqL6B/SOjRppvPYiU6Dmzl6nqaIOcIOZigtG9GUQp:M9m+qNTlRppn6AqoSZigk9GUQp
TLSH
T1B8936B4A6AB412A5D6F781B4D8D20B9DC331B01407A55BDF5288A35A1F23EE41F363FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 6845dc964e521a1f71d86a520a5a6535af6301398514da6d1a49c8ab4b9725b0
MD5 eeada1874586398ed8bdf1f3c912dc61
SHA1 24c7547fbb116ba15d1da38b649da9f4d9f32838
SHA512 13aab50c5c41f7c555b9fefe5ddb2b2a5be7ca990841a8bee3b2b08185c6fbc690ca5ebc811c2895d25cadccc26029f252f1907d14808c47b683cb5838d2f964
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 837eb9b1ce094ed7e35ba2fbfb8b7b16dab79c3f6753719a35c11eb56a547275
MD5 e4dc363dada2daa0adcede25faaf69fe
SHA1 aef91f355a915a48acec43a9c635432004847436
SHA512 82e278703de1be77bc21f90489903daabe637310dd38c92545d38811e1c02f1fa9c624cf7490d8e56cfa43f6c006967dc831aba596e2d387ee6d6e4a6c982b27
TLSH
T14BE02BD6C921EC3714FD1B6D70544A45E79403572B404D6F3E3D915C8FB863E418682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 363KB
SHA256 987520c161d9a0a6b78a6a2e9ac48fff7df21258a76f765ec62e3d7d872330bd
MD5 b889c4491374b48bd54967089c47b24f
SHA1 a4a0dc062539561c1cf4db1f4eeead5182d86e6b
SHA512 daaf9a7078b7ee13a69823aac7ad50c7dc417d5287bd53b838b11ee99c290a9d8f7cad868703041478e1acd000c7a2e2a97b8d742acce7ba3d933cfae4fba1ab
SSDEEP 6144:Md5+VYpEzQqG1X55Ay0K4P1ucWp6qD//wwgVfDhyeGHBdmtPWVkjOQV3u3:c+VfQq8DITWpNwxdhjGHBUZWCjOQto
TLSH
T1FF84233119E1CC63AC01838B0E0DB54FDA677D697BAC153E1042A8E7D1726BE5CB25B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 93c444992165cf41b87519a01ec54df693a4020faaf785b51bd778b704ed5a7a
MD5 469faba87ca1aafdacced409c12ceaee
SHA1 e14b215c97856f3eef6f0ea6c25cde74cd65e486
SHA512 2de84f40380e4487c48ac4103b6e4348eebcd2497c1b712ed3dbe8787241270223d95e3ee0f5c0f7ff3da27b6780a3837a26179ba507e99d17fe5ffbf9fcdd6b
TLSH
T1B4B0220C22808220C38832FC30080E00AC380EC0BA328323B8F200FC8C023B2C28B2C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 498ae4dfbc43be6381c6d6c67444a93faa1ce9f39906f012c5bdf8ee19b27365
MD5 4a867c30db001c676388e82273ce9915
SHA1 d55c4ec693d9b9d05da3001533ccf12181a3f66f
SHA512 940b1a49d76cbf894520cba21597715f10f19159b34e27835bcb439a72cfaf125c9a9f005c1ed77da85bcb2910f25f995ce3647fe6332e04b8efc82656dde4a3
TLSH
T1633176C405A8BD75CBD905BC71C26E01F0300D42E12B6E5E94CB23772F327EA95F2645
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 85a6b2a43d16193fe3669d4f0c9a89255444be698998a6e519844397287c1cc2
MD5 90b65fdfe79577b010d3f68c79cdf8ed
SHA1 e3c2be76745fe4c9146692e20400f855b461516b
SHA512 125db1868fcb26e34db332c20d11f952e5543cb13e5c8c64138e973d8a3a9b04800e05d658cb51b482d637f948eaa7f4f7ad1fdc396e0184ca2e45d1fa02dff5
TLSH
T1AB41DBEA44A97C3AE7E9403DB0D21D01F8300D06D21B2F9E55CB63331F227E852F1041
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 1c2e0bca5cc10e221c1d66fee21b3749af7661ea517eaa0e5f0b3e48e25127d3
MD5 d0ea8522119dc1edbde63a24a83ad0c8
SHA1 74526cf782732343a76a900e1783d949ba8e7244
SHA512 ef9d2309a153597353ecd2d5026158c74de3980bc828df456f573d88cc68f5b39b173981bc3f39d95f697a46404db10631dd5ad4df0f5ef3b8f2b5173cd0c3ff
SSDEEP 384:Dm9rzf2vRapoFhUF6p/rOsaIaSxObQ1eL4KI/s/Mo/IhpA8RLYzYwOiZg6uTZNRE:sH
TLSH
T10852A0F3C3D4866DC91166F4AF247E1BCE6E092453683C6AC8D4EF4BA7D2472E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0394f0bd97351646ac6e3b104f9a33ac4df1d453508a7e7886e35598e42b209f
MD5 687a18f3641c5c66a76b380f49f81d9a
SHA1 a5510db148f3e1e3a93d60edc8109c6f54076685
SHA512 cd2df276e3f9a0c46b2872338f9fa166525eb1cfdb3dc07ae12ca930c3ac657b3aac23a9b064ae5e721e138d1a20397f9baf78c6c5e09264539cfe7ad2c8b2a1
TLSH
T183515CF793E48AAE891196E4EB256E1FCD790A14131C3C66C9D4AF0B53F2972D24138E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 5222b5731ad8f426f402245b30642181628d81931f86dda2462a33a209229533
MD5 d7d7f71040ecae1f468a0d516d748f83
SHA1 38014d4218a1152c887a76e7a3a34c3e9f3cb721
SHA512 a6b5e4ac6663f46d1f2853647c66f4def2a875d2678b33c9f07ebeb9c90b2fafbf103f957886233cfc3d1838d4b87823993a9d8bf511f7afebe973e205731c2f
SSDEEP 384:Dm9rzf2vRapoFhUF6p/rOw4aIaSxObQ1eL4KI/s/MGIhpA8RLYzYwrZg6uTZNRQV:tB
TLSH
T1DA52A0F3C3D4866DC91126F5AF247E1BCD2E092453683C66C8D4EF4BA3E2472E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 8c0be0e3ece6b31a3b56b78aac5c91d7c07fce6346661324f97625ff3c5fca37
MD5 6490a77582b2fe999cec3aa52d3c89e6
SHA1 125204450be53b3ac5bd1d1c6db8dfcc54c10a84
SHA512 a2d60f1cbfe5718727e12886af1f5c8244c63d5cc3709ca8e92ed6b5696cbd437b294c1596e17f041a52c3a671049b72437e4b322ee2923de8451803e9ecb1d2
SSDEEP 192:Dm9rzf2vRapodaIaSxIDbQ1eL4KI/s/MoRPIhp8B8RLY0Ig:Dm9rzf2vRapodaIaSxObQ1eL4KI/s/Mj
TLSH
T1D412ADB3C3D4866DC91162F5AF247E1FCD2A0924536C3C66C9E4EF4B63E2472E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 2KB
SHA256 611835d969c959fdf6a3c1d8cf03fd5c55867285b04d87f94b6d39b87fb08412
MD5 dcba9c129165a96556610381c08c81fb
SHA1 d684541b102a0b28437628649f2260ef7c5e5b0f
SHA512 fc002e3fd4ff886c6fe16e1526b8d331087f39cb651808a18f6bf9914c085b18295516239a9a9d294ea38ebd09b48c663d7302180a0c6e5b92769a1edc7c8aa3
TLSH
T13C4170A7867FB46712798AAB5D0478061CBAB431029274F4DEBB837DB4854FB0B13027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 691B
SHA256 a38b88adc930fcb0d28c115ef4449f47ce61be82973dfc3b454e08deaded8b5a
MD5 098af1d97edca63b1f1005f7cf5e6b7e
SHA1 9217c55df1894bca9d581549db61869880ee384a
SHA512 fc2476aca8054e63dac1684a615d980439a9c47eccd99d845f632dd8759f6431d67e9f4c61b0f9fb7a3612b71bbd48930d02130b578f158e66900e3e4c2c111a
TLSH
T19C01946BA769786B11B945AF5E04740619BEB831554138F4CDA7826CE0C55F70F02047
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 dc585d49ec8b37696f22d7bd1c21c84fcfd26d46f3187315c95f8bde3e0003e3
MD5 f87b875b040e42ddf2dd4779a7a79b30
SHA1 7c18263ffc504905e5d7606f2b3af93c3dc16f32
SHA512 9b7371b56f5e40e7bb33159ee6d7eba1bc3e0296540ff7e0d9d14c2e1312609e34c640c163aa7af2cfe13ba9988fa722e17851ae862935c481b5487e6b5b05b6
SSDEEP 192:KRC1hNGdAd+OOcv7tYpAPRp2hm9CHsb+WNnZOdPneNI2TiL4aEIVyIsnAUgtaJ:KRC1nWxIhYUXem4wsdEI2TVaEs8
TLSH
T1C242D72EE914693B9CC6C219FE617757D7F6102131D82E94E6FCCA2C19EB9CD221B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0171e09f042ee200176d0d6e077af4aba9e8682874e0b43a6f28b7d1d3913f52
MD5 c4c8683b04fbe585d5aa930ee3c562c5
SHA1 ddff0db4583b249e1420ceee617be1c105976a1e
SHA512 72980f86a4ac988124d9c99d87979e7cec186ecb56a7290b830243494848e85c553537120f57faf54474d74a1db54ce74ebe9e4468d373d16f995b880b7c9618
SSDEEP 192:KRC1hNGdAd+OOuv7tYpAPRp2hm9CHsb+WNnZOddneNI2TiL4amIVyIsnAUgraJ:KRC1nWxKhYUXem4wsdOI2TVamse
TLSH
T18742E82EE914693B9CC6C219FA617B57D7F5102131D82E94E6FCCA2C19EB9CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 7148bf5b612a7b8855005249e184815b7443d00119427ca95baca287ea115a0c
MD5 e4ab0ace3dd4b043ce88f75ecefef3c8
SHA1 a73eb6f090ef7ebe90383fbf8b849621bba1dcab
SHA512 d091d6f8f81157f0249560a843e86db4a7398d7b927d7067a1f9d985bdf596429d9eefb0cda80543b17a5d9a88f51881bcdcc70ff688397e7f8b86d19a9ebe03
SSDEEP 192:yRC1hNGdAd+snv7tYhAPRp2hUJX9CHsb+WNnjAAoveMneNI2TiL4a50jVyIsnAUp:yRC1nWGvhY8XeE4wsne9I2TVa5oe
TLSH
T15D52082EE914693B9CC6C319FD627B6BD7F6102165C81E90E6FCCA2C19E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 71b70f0ecef0afb1c5a017f8cf57356178b65139e8c0577d2f902bb554744048
MD5 ea566b4e2b87f0d837d4d5005d9669c1
SHA1 e36e0b8a26647fdfdb3eaa15e91f3a0138ba9f19
SHA512 2c97c6292d20c38b8f7bd56ac89db3e68b1b6ba68ea8459dffea80c59ea9eb83126bc68fca09a01b251e5d1b319cfacfa96847b4b638e81fc8de9c4a98f12d9a
SSDEEP 192:yRC1hNGdAd+swv7tYhAPRp2h+X9CHsb+WNnjAA0b2IneNI2TiL4am0jVyIsnAUge:yRC1nWGshY8Xek4wsb2RI2TVamoe
TLSH
T16B52092EE914693B9CC6C319FD617B6BD7F6002161C82E94E6FCCA2C19E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6ebcf1a9d81326b243d8196b01368b8e9a42ed49d02dcbd2226e129f244842ce
MD5 5dc7a69f7e4419f8c204e5e0417b7a42
SHA1 663aac02b6a60f4817559dc9fc1bb8adfb300bec
SHA512 d339af60a8102754387d97740e602b8e6481aa4bde98424720bb097719a7eec161d3d275101d285c830870b3f8179a722d3b5f296d49004fcd986615dccd07e9
SSDEEP 384:0RSmz1nW+ShY3EXU3h4wJ3jYibI2TVatoe:7mz1W+YYPh4wC92gtx
TLSH
T15A62F92EE814693B9DC6C319F961BB6BD3F6102165C81E94E6FCCA2C19E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 006729ab45143da08bfe916f7fe43ed58756d82439b023158055a339d000fc4b
MD5 b58ddae2566bbf5cb6e19b3502a5aa19
SHA1 82cef675ddedb5071b7f2ccb1cbdfaf3c68990a3
SHA512 3b1ecc70d57efd2c4bd61080b6064cc8f76b7d4e6091681a1d142f1786d4ca09c5e2e7636b754eacdffa76fdfcdf3744ff447edfe48690925915d6e0bc503988
SSDEEP 384:0RSmz1nW+ehY3EXU3U4w+VgjYrbI2TVatofe:7mz1W+8YPU4wKo2gtoW
TLSH
T12F72C62BE420297B8DD6C319F961BB6BD3F6112265C41E84E6FCCE2C19D7ACD2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 e3e85507733b74e650902d1645f4c8e2a47131f5f4d003efbf580d80d51d1e18
MD5 d25832a19ff9c1c57c95ef5ecf3d457d
SHA1 30d5ae73ddd9dfab1127bd841aef79ad540016fb
SHA512 680876039281bd13201af5a0d12b9eed3257e3547eb60a743076a4ef44ddf64d39464fedf9d363ec15f80fae0d8dd3610e3a09d4d4a9512ce92d01878e2ab95f
SSDEEP 384:S0jWV7KxkXqKf/pUZNCgVLH2Hfgslvy7pLuLcifcdXODW1+ErU3IQHGtHkr0:SYWV7KxkXqKf/pUZNCgVLH2Hfgshy7pd
TLSH
T15372D8676C4C99370F94C6CCDC167E4FADB6024B65DD886893FA582A03D5ACF120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2c0a93b4422e6a506abe8fd0d7cb57f2c73df4855f6a7c86a762d0b73dc12b61
MD5 e2efb1a62d8fed14eaaf554ded1d1b5c
SHA1 0d834e5db137bb082ca323e3fe699697176ca445
SHA512 698f31e98dfab2aee8d5c6082f139419abb9ea0b1e0264d4fbba4b4de5fea3683153d427652d20bf8dd32781e2c31f6fb4d0f64c2ee8a739fe81c8b75e810bcd
TLSH
T1B3B01252C0015941C00343F45587149C71149F148B05170153E06A71B82659140291D0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 9440f2af09b7f9b277addd89a1d20b4a61c30f4f570289c915182d0037088ec7
MD5 a96ecf21103a5fbe24b722593e6c7bc4
SHA1 824353476ec0fac184edc81545a2ae6f4f7b7222
SHA512 815b5a3260724c922cf0001f292aef018f5afabac767cd519bcaa240f6da78d56a54e2b877cdbc95a2a8e048a54af521688b1fb363ac62dce9a19d63a1cad821
TLSH
T134C01251C503B031E05A23FC24D79DDC3215FF74DA05178857F069769E756105315252
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5adb9c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5adb9c.TMP
Size 96B
SHA256 8412e047be7d1ddc3267d955c9de0d11dd39e73467dc1deca729a3de61a22d23
MD5 7712bd57ea59e2eb4b96bff482c914e1
SHA1 3478a80d5193821fbd2f0f7b62e758b2f54fa36f
SHA512 34b068c26657472247a01f90dc488dbcfaa95067fec620f1bde52dff16dbae7940202d89168d6020f51752db06112c806a36d68ff6f42964804750a2ae7d6e89
TLSH
T18DB00255C2426213C0C203B1299EB9DCB166EF29C617131693F05B77DD3D66185265A1
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 07eb6d0637088eced47ece688d6caea231fbe6c0aa1ede7300b5c66bf6623400
MD5 e0c3b459da4cd17ebeb33fb46871acda
SHA1 5ca0a0a19bd5ffb937ba453766550a84249818c2
SHA512 95eb1d1194254fad05dba0cede40215faaea43bd80992433102d47275cbd655d3f1c188ab416f7b4a25a53c0398fa026b4a8df6141f160c4b7c128a95bc2fbc0
SSDEEP 3072:NNWWWbCGr3o3ssveOsjYiVNmhf13Qw/xLANk0mUW5GmRntSFCjEENz:OWXbssWOsPKhdrOk0HOGm/SFyEER
TLSH
T10C1412345B1A1F8F91FF859E2809BB49CD229709B347F8D8357887482AE13C91B55EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 c4708b412ae2c4d378e6e301d48a1b5ca3370cdee3fa1ec4edd4a0b18d9cff82
MD5 29932749c05c61c2af650738a0d17bca
SHA1 8ca808f53ae3f5a9e3a6e9be7d01ec76dc74e563
SHA512 84a8ebc4b58241bbd20537f78d433f3cae31b0d565bb4cbb93f4564e590652c4fdf169ed29e6761f83626ff8e2d8a409ac09d80c3eaf4afdd71bcc7f5819c740
SSDEEP 1536:TBivsz+CnAjhNoHWV0bCuiUm0r3Q02/B7t88sNK9+OheOqBjWziSbQcEmhPHX:kNWWWbCGr3o3ssveOsjYiVNmhfX
TLSH
T112C30220571D1F0E92EB855E4805BB99DD71DB6AFB01F8E46CB8CF001AE73D51249AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 1cf52c5f1a784d6eb0e7aea7daaac2b4c2ebbaf30f34920a541c4c4c68eae28e
MD5 5faef6278866acea23a0a6787cdd64f6
SHA1 30b8ed6ab63cbb742e5596e4145394c9218f7f43
SHA512 07c0d1dda28227156b7312ffc49c4cc8bbe65322281f96be409778b3669019d0f3d2dfe55da496bf534e4a103fcf7025a182d0b19c3e06fbadfd2e680e622ac5
SSDEEP 3072:KNWWWbCGr3o3ssveOsjYiVNmhf13Qw/xLANk0mUW5GmRntSFCjEENz:bWXbssWOsPKhdrOk0HOGm/SFyEER
TLSH
T1EC1412345B1A1F8F91FF859E2809BB49CD229709B347F8D8357887482AE13C91B55EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a693141ced139f92a8db68d564cf6da815e8e8995802c059dab52925c059fa88
MD5 39a627eaa3a6d823dfc7014c3d37e674
SHA1 85b5fe7f843fe8e5b2110e12a43cac8f704f939f
SHA512 e6e427576203a2726da8db348c750ac0f46de394009daad61cf33eed1c7c8ec4dec09b81599b97e22eb92308d63c3c498264d3849b896d17f9d9fdf6846a00c4
SSDEEP 1536:TBijsz+CnAjhNoHWV0bCuiUm0r3Q02/B7t88sNK9+OheOqBjWziSbQcEmhPHX:MNWWWbCGr3o3ssveOsjYiVNmhfX
TLSH
T190C30230571D5E0F91FB855E5805B799DCB1E767FB01F8E8BCA88F001AE63C816499E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 c050bed9453b8d27d011048c650174cc0538e59499437c82c66bc4271b56d8c2
MD5 1aa798bc657bc4f3305209822cac1b3a
SHA1 5343d07fb9ccab3b4f68f563a9516d358266c615
SHA512 422b86204525b91354ff3340fd6af502cf64e68b1357643fbb4a8a7790b6b797e85818a5ac98c6b210d9bec2c1cbd607876e5e3381eeee39dd244ac67d03679c
SSDEEP 1536:TBiKsz+CnAjhNoHWV0bCuiUm0r3Q02/B7t88sNK9+OheOqBjWziSbQcEmhPHX:XNWWWbCGr3o3ssveOsjYiVNmhfX
TLSH
T156C30230571D5E0F91FB855E5805B799DCB1E767FB01F8E87CA88F001AE63C81649AE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 5feee5bc1bc0415aabae3a81f4e72f8efe6bf5a7e0e41aff3f138b3ccd7e8ca7
MD5 e42bcbb459ef53e0e80c63f445e9a04d
SHA1 95242809d5cbfbd33933b8355f818aad74b5becf
SHA512 c1165be3ea1723f379321a7640a14eebd96d72f0c763eb9463bf048c9376cf929aefe32ef52a8e5d995e6ae8ff0d41da98406644b66071bb84ae2a27769400e3
SSDEEP 3072:rNWWWbCGr3o3ssveOsjYiVNmhf13Qw/xLANk0mUW5GmRntSFCjEENz:sWXbssWOsPKhdrOk0HOGm/SFyEER
TLSH
T1891412245B1A1F8F91FF859E2809BB49CD229709B347F8D8357887482AE13C91B55EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 7903e58fe887c5c60dc1a78e9a71e20673f14d9e0ec6e00de1cec3a77c529d5f
MD5 3c60b7234f9381cbdb4f1d200ace77a5
SHA1 5f875e3929d8a5ec425743973b3a1e0e6023e4cc
SHA512 f4083474eb44244701a8c7c4a69e27ee6603d0c4bce73bae3e77fda2bee821db2806c5eb0ca65996f0c956945715f4d563f2b9162c0cc601ea49f37318b07a60
SSDEEP 1536:0NMcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEB:IM3Qw/xLANk0mUW5GmRntSFCjEEN3
TLSH
T1429302BA4E1A46E7957E4AC176AD7808CE22130D70AFA9CC316C639D61941C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b38f4c1068b7e827ed9f38313e277d7d44d0309be5769d212a29618b862d3e18
MD5 0a63e662cde9e7bd60ef7939aba37dd9
SHA1 a3592b452d893782b6a422ddc77970d07edede7b
SHA512 92464d9a64dd66692d05221928687dc5bb5ee584b89f4bab57e684210401807af0e2a7d63835670c4d76732372a52358f661afab508a231cf805f3295464987b
SSDEEP 3:MsEllllkEthXllkl2zEklhValll:/M/xT02znDat
TLSH
T1FB4404047FC44405C50014704431DF5137F0D41C051157433473C4335CC55410C00140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
Size 28KB
SHA256 3059a62f9d0a22338dabe9a896d7357e52b06108a0b8973cf6e85663821bddba
MD5 5b18903ca5e5aa525ffa752fbbd1b3fa
SHA1 fdce2db48e86b40083b0d1a2dd2d0a3e72c7e999
SHA512 993a2c50b18ab6a5755fceff7452498149fc0fb97c3b7c4f3c9d7637105c9cb42a96a102fc99253a447eff8fbb5a8ff71d2f7544fa6b56930e29745a548f4d3c
SSDEEP 96:nXiC86eCLVV6FKt6jJx8huZwdhUNs/jQ+uOd:nST6eUVV6FKt6jJPauO
TLSH
T125D2F9427E34C651D40A2A7C6D2FDBDE6C69FDC5CE1404A73AF1F7AF85B480B8225408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shift_Setup (3).tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3GI9PCDADK.tmp\Shift_Setup (3).tmp
Size 4.2MB
SHA256 d3b08ebede5a2555e28e1da067a21785afa309a340d16a1677f0e6a8c2c52837
MD5 2b95cb7a12ffb6377028d43eff1d65ad
SHA1 f12376389585c68fa2b7196accc7ef549c9a3b29
SHA512 3a2d58f0952cf2acca1927a147dcf95ad71ca87c14b510e45fc8f442a09b1a5b5e869322c66b775abcc5f4afbab304b117ef03776d6c92daa1adf801039946ee
SSDEEP 98304:5YU5hnuOajWwMPdCpepI3GrwrA+Js333Ps:7xuHjWfZIzes
TLSH
T1E5268F03F388753EE4571A3A583FA280983F7A213915CD4B6BFC295C8F396416D2A797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/376-11349-0x00000289BD630000-0x00000289BD6FD000-memory.dmp

Download

memory/376-11333-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/1288-11262-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/1288-11276-0x000002620A4C0000-0x000002620A58D000-memory.dmp

Download

memory/1384-11227-0x00007FFC3D620000-0x00007FFC3DC54000-memory.dmp

Download

memory/1384-11241-0x000001C5A9D50000-0x000001C5A9E1D000-memory.dmp

Download

memory/1436-11387-0x00000231AEC00000-0x00000231AECCD000-memory.dmp

Download

memory/1436-11358-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/1704-11373-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/1704-11410-0x000001F071540000-0x000001F07160D000-memory.dmp

Download

memory/1712-7-0x0000000003030000-0x0000000003103000-memory.dmp

Download

memory/1712-11217-0x0000000000CC0000-0x0000000000DA9000-memory.dmp

Download

memory/1712-1-0x0000000000CC0000-0x0000000000DA9000-memory.dmp

Download

memory/1712-11218-0x0000000003030000-0x0000000003103000-memory.dmp

Download

memory/1712-6-0x0000000000CC0000-0x0000000000DA9000-memory.dmp

Download

memory/1716-11402-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/2076-11348-0x0000022B343D0000-0x0000022B3449D000-memory.dmp

Download

memory/2076-11324-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/2464-11219-0x000001B4F0670000-0x000001B4F073D000-memory.dmp

Download

memory/2464-11195-0x00007FFC3D620000-0x00007FFC3DC54000-memory.dmp

Download

memory/2504-11293-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/2504-11300-0x00000293E6C30000-0x00000293E6CFD000-memory.dmp

Download

memory/2612-11350-0x0000025F474C0000-0x0000025F4758D000-memory.dmp

Download

memory/2612-11341-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/2744-11405-0x000002A22D230000-0x000002A22D2FD000-memory.dmp

Download

memory/2744-11365-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/3984-11302-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/3984-11316-0x00000239D3D20000-0x00000239D3DED000-memory.dmp

Download

memory/4300-11284-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/4300-11291-0x000002114A110000-0x000002114A1DD000-memory.dmp

Download

memory/4420-11328-0x000002087B1E0000-0x000002087B2AD000-memory.dmp

Download

memory/4420-11309-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/4484-11388-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/4652-11376-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/4652-11419-0x000001FF5DD40000-0x000001FF5DE0D000-memory.dmp

Download

memory/4836-7425-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-14-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-11215-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-11216-0x0000000003430000-0x0000000003503000-memory.dmp

Download

memory/4836-9-0x0000000003430000-0x0000000003503000-memory.dmp

Download

memory/4836-8-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-10-0x0000000001770000-0x0000000001771000-memory.dmp

Download

memory/4836-10437-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-5-0x0000000001770000-0x0000000001771000-memory.dmp

Download

memory/4836-3000-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-787-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-18-0x00000000006A0000-0x0000000000AEB000-memory.dmp

Download

memory/4836-19-0x0000000003430000-0x0000000003503000-memory.dmp

Download

memory/4976-11411-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/5024-11340-0x000001B94BBD0000-0x000001B94BC9D000-memory.dmp

Download

memory/5024-11317-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/5440-11368-0x000001FD1F0A0000-0x000001FD1F16D000-memory.dmp

Download

memory/5440-11351-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/5840-11391-0x00007FFC3D280000-0x00007FFC3D8B4000-memory.dmp

Download

memory/5840-11420-0x000001F70E010000-0x000001F70E0DD000-memory.dmp

Download

memory/5908-11244-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11243-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11242-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11251-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11254-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11253-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11252-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11250-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11249-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11248-0x000002E0FD470000-0x000002E0FD471000-memory.dmp

Download

memory/5908-11292-0x000002E0F5B00000-0x000002E0F5BAC000-memory.dmp

Download