Overview

overview

8

Static

static

3

Shift - Ma...w5.exe

windows10-2004-x64

8

Shift - Ma...w5.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    162s
  • max time network
    227s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 11:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Shift - Manuals_xl68w5.exe
  • Size 8.5MB
  • Sample260622-m7jansbs2n
  • SHA256 c7aebf302a513ee48d813b9333f831f1a542e9fd13294d9a61ed9510a717f8a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryinstallerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 27 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 9 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Shift - Manuals_xl68w5.exe
    "C:\Users\Admin\AppData\Local\Temp\Shift - Manuals_xl68w5.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Users\Admin\AppData\Local\Temp\is-NUNOM.tmp\Shift - Manuals_xl68w5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NUNOM.tmp\Shift - Manuals_xl68w5.tmp" /SL5="$701F0,7452306,1214464,C:\Users\Admin\AppData\Local\Temp\Shift - Manuals_xl68w5.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\Users\Admin\AppData\Local\Temp\Shift - Manuals_xl68w5.exe
        "C:\Users\Admin\AppData\Local\Temp\Shift - Manuals_xl68w5.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMzUyMTg1MjI4MiIsInByb2ZpbGUiOiJzaGlmdC1tYW51YWxzIiwidXRtX21lZGl1bSI6IiIsInVhIjoiZWRnZSIsImxvY2FsZSI6ImVuLWF1IiwiaW5zdGFsbGVyX2ZpbGVuYW1lIjoic2hpZnQtdjE0NC4zLjItd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMzUxMjEyMzgxOCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JNnJLS3diaWFsUU1WZE9HRUFCMFRFaVE1RUFFWUFTQUFFZ0tkcFBEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy90aGFua3MiLCJscF91cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy8xIiwicHJvZmlsZV9pZCI6MTA2LCJkaXN0aW5jdF9pZCI6IjU1NmMyYTFlLWFmODgtNDI3Yy05ODkyLTUyNDNkMzhjZGQ1YyIsImxhbmciOiJlbiIsIndoaXRlbGFiZWwiOiJtYW51YWxzIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fc291cmNlIjoib2gtcG1heCIsImluc3RhbGxfdGltZSI6MTc4MjEyNjM5NywiZGVmYXVsdF9icm93c2VyIjoiTWljcm9zb2Z0IEVkZ2UiLCJpbml0aWFsX3ZlcnNpb24iOiIxNDQuMy4yLjIyMiIsImF0dHJpYnV0aW9uX2tleSI6InhsNjh3NSIsInNwbGl0IjoiYSIsInNwbGl0MiI6ImIiLCJub19zcGxpdCI6ZmFsc2V9 /SPLITS=eyJzcGxpdCI6ImEiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMzkxX2RvbnRfaW1wb3J0X2hpc3RvcnkiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3QxMjMyX3JlbmFtZV9zaG9ydGN1dHNfc2hpZnRfYnJvd3NlciI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q5MzE5XzN3YXlfb21uaWJveF9mb2N1cyI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQ1NzNfaW1wcm92ZV9icmluZ190b19mb3JlZ3JvdW5kIjp7InZhbHVlIjoidmFyaWF0aW9uMiJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ9 /LAUNCHER /VERYSILENT
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Users\Admin\AppData\Local\Temp\is-90SG5.tmp\Shift - Manuals_xl68w5.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-90SG5.tmp\Shift - Manuals_xl68w5.tmp" /SL5="$4012E,7452306,1214464,C:\Users\Admin\AppData\Local\Temp\Shift - Manuals_xl68w5.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMzUyMTg1MjI4MiIsInByb2ZpbGUiOiJzaGlmdC1tYW51YWxzIiwidXRtX21lZGl1bSI6IiIsInVhIjoiZWRnZSIsImxvY2FsZSI6ImVuLWF1IiwiaW5zdGFsbGVyX2ZpbGVuYW1lIjoic2hpZnQtdjE0NC4zLjItd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMzUxMjEyMzgxOCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JNnJLS3diaWFsUU1WZE9HRUFCMFRFaVE1RUFFWUFTQUFFZ0tkcFBEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy90aGFua3MiLCJscF91cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy8xIiwicHJvZmlsZV9pZCI6MTA2LCJkaXN0aW5jdF9pZCI6IjU1NmMyYTFlLWFmODgtNDI3Yy05ODkyLTUyNDNkMzhjZGQ1YyIsImxhbmciOiJlbiIsIndoaXRlbGFiZWwiOiJtYW51YWxzIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fc291cmNlIjoib2gtcG1heCIsImluc3RhbGxfdGltZSI6MTc4MjEyNjM5NywiZGVmYXVsdF9icm93c2VyIjoiTWljcm9zb2Z0IEVkZ2UiLCJpbml0aWFsX3ZlcnNpb24iOiIxNDQuMy4yLjIyMiIsImF0dHJpYnV0aW9uX2tleSI6InhsNjh3NSIsInNwbGl0IjoiYSIsInNwbGl0MiI6ImIiLCJub19zcGxpdCI6ZmFsc2V9 /SPLITS=eyJzcGxpdCI6ImEiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMzkxX2RvbnRfaW1wb3J0X2hpc3RvcnkiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3QxMjMyX3JlbmFtZV9zaG9ydGN1dHNfc2hpZnRfYnJvd3NlciI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q5MzE5XzN3YXlfb21uaWJveF9mb2N1cyI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQ1NzNfaW1wcm92ZV9icmluZ190b19mb3JlZ3JvdW5kIjp7InZhbHVlIjoidmFyaWF0aW9uMiJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ9 /LAUNCHER /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5372
          • C:\Users\Admin\AppData\Local\Temp\Shift Setup_xl68w5.exe
            "C:\Users\Admin\AppData\Local\Temp\Shift Setup_xl68w5.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMzUyMTg1MjI4MiIsInByb2ZpbGUiOiJzaGlmdC1tYW51YWxzIiwidXRtX21lZGl1bSI6IiIsInVhIjoiZWRnZSIsImxvY2FsZSI6ImVuLWF1IiwiaW5zdGFsbGVyX2ZpbGVuYW1lIjoic2hpZnQtdjE0NC4zLjItd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMzUxMjEyMzgxOCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JNnJLS3diaWFsUU1WZE9HRUFCMFRFaVE1RUFFWUFTQUFFZ0tkcFBEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy90aGFua3MiLCJscF91cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy8xIiwicHJvZmlsZV9pZCI6MTA2LCJkaXN0aW5jdF9pZCI6IjU1NmMyYTFlLWFmODgtNDI3Yy05ODkyLTUyNDNkMzhjZGQ1YyIsImxhbmciOiJlbiIsIndoaXRlbGFiZWwiOiJtYW51YWxzIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fc291cmNlIjoib2gtcG1heCIsImluc3RhbGxfdGltZSI6MTc4MjEyNjM5NywiZGVmYXVsdF9icm93c2VyIjoiTWljcm9zb2Z0IEVkZ2UiLCJpbml0aWFsX3ZlcnNpb24iOiIxNDQuMy4yLjIyMiIsImF0dHJpYnV0aW9uX2tleSI6InhsNjh3NSIsInNwbGl0IjoiYSIsInNwbGl0MiI6ImIiLCJub19zcGxpdCI6ZmFsc2V9 /SPLITS=eyJzcGxpdCI6ImEiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMzkxX2RvbnRfaW1wb3J0X2hpc3RvcnkiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3QxMjMyX3JlbmFtZV9zaG9ydGN1dHNfc2hpZnRfYnJvd3NlciI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q5MzE5XzN3YXlfb21uaWJveF9mb2N1cyI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQ1NzNfaW1wcm92ZV9icmluZ190b19mb3JlZ3JvdW5kIjp7InZhbHVlIjoidmFyaWF0aW9uMiJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ9
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3196
            • C:\Users\Admin\AppData\Local\Temp\is-946U5.tmp\Shift Setup_xl68w5.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-946U5.tmp\Shift Setup_xl68w5.tmp" /SL5="$301C4,172433327,1214464,C:\Users\Admin\AppData\Local\Temp\Shift Setup_xl68w5.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMzUyMTg1MjI4MiIsInByb2ZpbGUiOiJzaGlmdC1tYW51YWxzIiwidXRtX21lZGl1bSI6IiIsInVhIjoiZWRnZSIsImxvY2FsZSI6ImVuLWF1IiwiaW5zdGFsbGVyX2ZpbGVuYW1lIjoic2hpZnQtdjE0NC4zLjItd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMzUxMjEyMzgxOCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JNnJLS3diaWFsUU1WZE9HRUFCMFRFaVE1RUFFWUFTQUFFZ0tkcFBEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy90aGFua3MiLCJscF91cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy8xIiwicHJvZmlsZV9pZCI6MTA2LCJkaXN0aW5jdF9pZCI6IjU1NmMyYTFlLWFmODgtNDI3Yy05ODkyLTUyNDNkMzhjZGQ1YyIsImxhbmciOiJlbiIsIndoaXRlbGFiZWwiOiJtYW51YWxzIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fc291cmNlIjoib2gtcG1heCIsImluc3RhbGxfdGltZSI6MTc4MjEyNjM5NywiZGVmYXVsdF9icm93c2VyIjoiTWljcm9zb2Z0IEVkZ2UiLCJpbml0aWFsX3ZlcnNpb24iOiIxNDQuMy4yLjIyMiIsImF0dHJpYnV0aW9uX2tleSI6InhsNjh3NSIsInNwbGl0IjoiYSIsInNwbGl0MiI6ImIiLCJub19zcGxpdCI6ZmFsc2V9 /SPLITS=eyJzcGxpdCI6ImEiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMzkxX2RvbnRfaW1wb3J0X2hpc3RvcnkiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3QxMjMyX3JlbmFtZV9zaG9ydGN1dHNfc2hpZnRfYnJvd3NlciI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q5MzE5XzN3YXlfb21uaWJveF9mb2N1cyI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQ1NzNfaW1wcm92ZV9icmluZ190b19mb3JlZ3JvdW5kIjp7InZhbHVlIjoidmFyaWF0aW9uMiJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ9
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1116
              • C:\Windows\system32\schtasks.exe
                "schtasks" /delete /tn ShiftLaunchTask /f
                7⤵
                  PID:2780
                • C:\Windows\system32\icacls.exe
                  "icacls" "C:\Users\Admin\AppData\Local\Shift\chromium" /grant *S-1-15-3-1024-3424233489-972189580-2057154623-747635277-1604371224-316187997-3786583170-1043257646:(OI)(CI)(RX) /t
                  7⤵
                  • Modifies file permissions
                  PID:4460
                • C:\Windows\system32\icacls.exe
                  "icacls" "C:\Users\Admin\AppData\Local\Shift\chromium" /grant *S-1-15-3-1024-2302894289-466761758-1166120688-1039016420-2430351297-4240214049-4028510897-3317428798:(OI)(CI)(RX) /t
                  7⤵
                  • Modifies file permissions
                  PID:4476
                • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                  "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:792
                  • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                    C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=144.3.2.222 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd40d6ef70,0x7ffd40d6ef7c,0x7ffd40d6ef88
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4768
                  • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                    "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=2072,i,4096649410358096637,1131237996778007780,524288 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2160 /prefetch:11
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Time Discovery
                    PID:4160
                  • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                    "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1788,i,10250749458652409355,15470920523505602397,262144 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2128 /prefetch:2
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:5080
                  • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                    "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2520,i,14794006330304182714,6131077075147134321,524288 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2672 /prefetch:13
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1060
                  • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                    "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=3556,i,1866506234334713804,9848932365248698509,524288 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3604 /prefetch:14
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4168
                  • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                    "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3832,i,7607163326774677984,10047285034549000213,2097152 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3848 /prefetch:9
                    8⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4828
                  • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                    "c:\program files (x86)\microsoft\edge\application\msedge.exe" https://app.shift.com/manuals/thanks?data=eyJhZF9ibG9ja2VyX2RldGVjdGVkIjpmYWxzZSwiYXR0cmlidXRpb25fa2V5IjoieGw2OHc1IiwiZGVmYXVsdF9icm93c2VyIjoiTWljcm9zb2Z0IEVkZ2UiLCJkaXN0aW5jdF9pZCI6IjU1NmMyYTFlLWFmODgtNDI3Yy05ODkyLTUyNDNkMzhjZGQ1YyIsImdhZF9jYW1wYWlnbmlkIjoiMjM1MTIxMjM4MTgiLCJnYWRfc291cmNlIjoiNSIsImdjbGlkIjoiRUFJYUlRb2JDaE1JNnJLS3diaWFsUU1WZE9HRUFCMFRFaVE1RUFFWUFTQUFFZ0tkcFBEX0J3RSIsImluaXRpYWxfdmVyc2lvbiI6IjE0NC4zLjIuMjIyIiwiaW5zdGFsbF90aW1lIjoxNzgyMTI2Mzk3LCJpbnN0YWxsZXJfZmlsZW5hbWUiOiJzaGlmdC12MTQ0LjMuMi13ZWIuZXhlIiwibGFuZyI6ImVuIiwibG9jYWxlIjoiZW4tYXUiLCJscF91cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy8xIiwibm9fc3BsaXQiOmZhbHNlLCJwcm9maWxlIjoic2hpZnQtbWFudWFscyIsInByb2ZpbGVfaWQiOjEwNiwic3BsaXQiOiJhIiwic3BsaXQyIjoiYiIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vbWFudWFscy90aGFua3MiLCJ1YSI6ImVkZ2UiLCJ1dG1fY2FtcGFpZ24iOiIyMzUyMTg1MjI4MiIsInV0bV9jb250ZW50IjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwidXRtX3Rlcm0iOiIiLCJ3aGl0ZWxhYmVsIjoibWFudWFscyJ9
                    8⤵
                    • Drops file in Windows directory
                    • Enumerates system info in registry
                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                    • Suspicious use of WriteProcessMemory
                    PID:3452
                    • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                      "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=c:\program files (x86)\microsoft\edge\application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x318,0x7ffd3f2dc188,0x7ffd3f2dc194,0x7ffd3f2dc1a0
                      9⤵
                        PID:4268
                      • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,6026957677753040810,7784468724672445719,262144 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
                        9⤵
                          PID:2136
                        • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                          "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1724,i,6267582833657377698,13404879672121165135,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:11
                          9⤵
                          • System Time Discovery
                          PID:4800
                        • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                          "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,6871132670571215795,9749165957382477963,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
                          9⤵
                            PID:5260
                          • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                            "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3340,i,7473190424638482542,8988769330212501121,2097152 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:1
                            9⤵
                              PID:3136
                            • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                              "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3348,i,15454212051222750322,770847336237081168,2097152 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
                              9⤵
                                PID:5460
                              • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,16669199863530728206,6801600116583100770,2097152 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                                9⤵
                                  PID:4564
                                • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                  "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16861472320483987766,10049931942191836441,2097152 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
                                  9⤵
                                    PID:3408
                                  • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                    "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,13578245241933237398,10269013238250404180,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
                                    9⤵
                                      PID:2540
                                    • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                      "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,806097105880916746,3933197305637505480,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
                                      9⤵
                                        PID:3700
                                      • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4044131869429780793,15745941637970725946,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
                                        9⤵
                                          PID:2088
                                        • \??\c:\program files (x86)\microsoft\edge\application\139.0.3405.125\identity_helper.exe
                                          "c:\program files (x86)\microsoft\edge\application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13877461049412939174,10538636994174800844,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                          9⤵
                                            PID:1556
                                          • \??\c:\program files (x86)\microsoft\edge\application\139.0.3405.125\identity_helper.exe
                                            "c:\program files (x86)\microsoft\edge\application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,13877461049412939174,10538636994174800844,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                            9⤵
                                              PID:4384
                                            • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                              "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,15963053382909295343,5465864981663437159,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
                                              9⤵
                                                PID:5164
                                              • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                                "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,16016311905089524838,15230413554909638199,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
                                                9⤵
                                                  PID:5024
                                                • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                                  "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,12372732610332043633,9227840400642169101,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
                                                  9⤵
                                                    PID:6444
                                                  • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                                    "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,346721560641135935,15482931062530741341,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:14
                                                    9⤵
                                                      PID:6452
                                                    • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                                      "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,7775096067846751959,17844354359805117792,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
                                                      9⤵
                                                        PID:6460
                                                      • \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
                                                        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,758460192148936816,17309994561746685514,524288 --field-trial-handle=2248,i,7391675541948640448,1865033058739480130,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
                                                        9⤵
                                                          PID:6968
                                                      • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                                                        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4564,i,5056289280278768415,6713514182539446536,2097152 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4568 /prefetch:1
                                                        8⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        PID:4544
                                                      • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                                                        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5276,i,7001359547936752925,13683689617169966864,2097152 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5284 /prefetch:1
                                                        8⤵
                                                          PID:1200
                                                        • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                                                          "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5492,i,9019887773282418652,12611526062770114370,2097152 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5476 /prefetch:1
                                                          8⤵
                                                            PID:5800
                                                          • C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                                                            "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,2327860993508082073,3327820021913324912,524288 --field-trial-handle=2132,i,10059699682141851259,11700677952981881377,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3088 /prefetch:14
                                                            8⤵
                                                              PID:940
                                                          • C:\Windows\system32\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\delete_is-3JCJI.tmp.bat""
                                                            7⤵
                                                              PID:4336
                                                • C:\Windows\system32\sihost.exe
                                                  sihost.exe
                                                  1⤵
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3012
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe /LOADSAVEDWINDOWS
                                                    2⤵
                                                    • Boot or Logon Autostart Execution: Active Setup
                                                    • Enumerates connected drives
                                                    • Checks SCSI registry key(s)
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3824
                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2016
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                  • Modifies registry class
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5992
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                  1⤵
                                                    PID:3848
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                    1⤵
                                                      PID:780
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:5024
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                        1⤵
                                                          PID:6168

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Active Setup

                                                              1
                                                              T1547.014

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Active Setup

                                                              1
                                                              T1547.014

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Defense Evasion

                                                              File and Directory Permissions Modification

                                                              1
                                                              T1222

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Peripheral Device Discovery

                                                              2
                                                              T1120

                                                              Query Registry

                                                              6
                                                              T1012

                                                              System Information Discovery

                                                              5
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              System Time Discovery

                                                              1
                                                              T1124

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              settings.dat
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                              • Size 280B
                                                              • SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 3KB
                                                              • SHA256 32a8b0925e330cd427fbb97328632a5e4e6203315d8dff5b88083b13148e2315
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5bb562.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bb562.TMP
                                                              • Size 3KB
                                                              • SHA256 89718c18dfee693a79dfce858a517320d2aa48c71ce8dfbfc901e5fd93e738c7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Edge Profile.ico
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                              • Size 70KB
                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Sdch Dictionaries
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                              • Size 40B
                                                              • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              cef7cb77-6c52-4163-8985-d8ca5acf76a0.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cef7cb77-6c52-4163-8985-d8ca5acf76a0.tmp
                                                              • Size 2B
                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 14KB
                                                              • SHA256 ce6cb63d1ed2b8ef4ee98850398022d3f0138aaf575aeae0d511a7ed108613fd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                              • Size 15KB
                                                              • SHA256 a900509bb2ef74d02d8e3c3484c7c0263b86da5c5da7128402316fabb7f66990
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Secure Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                              • Size 32KB
                                                              • SHA256 7a6e8e51908d9567e9e0c30d607e0bb835b19154ad28772cd50a42f126bd9020
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                              • Size 72B
                                                              • SHA256 5d1216a7c20ef21c119a47cf79e07c5cda3fd02cdff82f368ffc3ce206a84248
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5ba005.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ba005.TMP
                                                              • Size 48B
                                                              • SHA256 9dc447cae82e5c275707bf893d65f563d7fdb952ebe442e07f122f454f4ef557
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              OperationConfig
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                              • Size 22KB
                                                              • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              OperationConfig~RFe5c2d41.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5c2d41.TMP
                                                              • Size 3KB
                                                              • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 35KB
                                                              • SHA256 982825cdaba81a8c5062ff772bb2e8c950e251485c0eeff2a4abfd7aa9b0c838
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 35KB
                                                              • SHA256 a41028814aff40fa971834448656c6aa04dccc87f30281e2bf39c3f379b07d27
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 35KB
                                                              • SHA256 7dd71ba6a10f7c6b09081d0f9cc2f6b139ea1bed982b1c0a1f5279a84736e682
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                              • Size 38KB
                                                              • SHA256 a7a98779b94084aeb355312c1a1358accfca4729b3acb9eccafe7e922f9c0cdb
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              c23e7688-3323-43d7-a92a-87b3b563081e.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c23e7688-3323-43d7-a92a-87b3b563081e.tmp
                                                              • Size 13B
                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              prep_Activatable Class_Hermes_perf.cache
                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                              • Size 599B
                                                              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              BookmarkMergedSurfaceOrdering
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\BookmarkMergedSurfaceOrdering
                                                              • Size 6B
                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              data_0
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_0
                                                              • Size 8KB
                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                              • MD5 SHA1 SHA512 SSDEEP
                                                              Submit Download

                                                              data_2
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_2
                                                              • Size 8KB
                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                              • MD5 SHA1 SHA512 SSDEEP
                                                              Submit Download

                                                              data_3
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_3
                                                              • Size 8KB
                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                              • MD5 SHA1 SHA512 SSDEEP
                                                              Submit Download

                                                              f_00001e
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00001e
                                                              • Size 156KB
                                                              • SHA256 f06caabc58fc152998c9a69b32150f4a7a92a0f51de809339928934f71274cb6
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                              • Size 1KB
                                                              • SHA256 6b087369bd3a6ebfe240d831c2dd7386cc25a2d2832074fd1baa516cf34fe53a
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5c1c1b.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c1c1b.TMP
                                                              • Size 48B
                                                              • SHA256 4c7b1066189ddce6eac9a84621fdce5c43c0337b8d608021c7e6ca5a837f6774
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              data_1
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\DawnGraphiteCache\data_1
                                                              • Size 264KB
                                                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                              • MD5 SHA1 SHA512 SSDEEP
                                                              Submit Download

                                                              MANIFEST-000001
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Extension Rules\MANIFEST-000001
                                                              • Size 41B
                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Preferences
                                                              • Size 10KB
                                                              • SHA256 b15163a13a2b9a151d91cb343082a88c16e5d01b1245c0f0c9842b1667f5b4ac
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Preferences
                                                              • Size 10KB
                                                              • SHA256 9002f6dc98ff81f87038993bd81ba205279a9ff4bf20b5f1e329bc5bf42c4139
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Preferences~RFe5b8653.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Preferences~RFe5b8653.TMP
                                                              • Size 9KB
                                                              • SHA256 de8494fab705dca37214f10c3b79c27a842a1fb84afa6a7b238335980fefd565
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              CURRENT
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Site Characteristics Database\CURRENT
                                                              • Size 16B
                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\js\index-dir\the-real-index
                                                              • Size 168B
                                                              • SHA256 1e696f739335456e3dbc1854720daaf2427b83823be146bc64b210972a167d7d
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5b9027.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\js\index-dir\the-real-index~RFe5b9027.TMP
                                                              • Size 48B
                                                              • SHA256 076bb1c59681c1f37ee1cdf4cc3deb8534a95a327fd97eeff3ef332db0ce09ca
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\CacheStorage\6700f448ce187ddfb47556fe16d6d9b5e16eb264\ee37d490-c352-425f-b481-c24fa2eb5c99\index-dir\the-real-index
                                                              • Size 120B
                                                              • SHA256 fc2702f49559f8931b635088d42b7e88e8b70c3ed35e9bf5652ecfd92e2d26ba
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5ba247.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\CacheStorage\6700f448ce187ddfb47556fe16d6d9b5e16eb264\ee37d490-c352-425f-b481-c24fa2eb5c99\index-dir\the-real-index~RFe5ba247.TMP
                                                              • Size 48B
                                                              • SHA256 64316633e5374c18d0721adf7664a49e5926ce233988295da54542dbd02250c6
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              index.txt
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\CacheStorage\6700f448ce187ddfb47556fe16d6d9b5e16eb264\index.txt
                                                              • Size 222B
                                                              • SHA256 85686670339c8c3961d28a5037ae65e532ac92ea30eb1d8da48261907f2a52c9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              index.txt~RFe5ba286.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\CacheStorage\6700f448ce187ddfb47556fe16d6d9b5e16eb264\index.txt~RFe5ba286.TMP
                                                              • Size 226B
                                                              • SHA256 38264c3ca06c0c71c3f4141fc73a9da33cbd00e3d993510aefdfa500ffd87bf9
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index-dir\the-real-index
                                                              • Size 144B
                                                              • SHA256 aacccbeed3d0fd9a7cc7fc7b53211151fe590985bbb94c5bcfaa76b868480e24
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              the-real-index~RFe5b871e.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b871e.TMP
                                                              • Size 72B
                                                              • SHA256 6cab8f6bbf6f7c99ff827ded96d4ac3328fe7d79f7605a87f42f2cd5fd3f318f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              index
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Shared Dictionary\cache\index
                                                              • Size 24B
                                                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              aee5d15c-f7f2-44a1-ac91-2eaf23a6d43e.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\aee5d15c-f7f2-44a1-ac91-2eaf23a6d43e.tmp
                                                              • Size 199KB
                                                              • SHA256 d5b9a0bce0d3852b521362d929b1d263435024af37b1a0b268522867d7f82069
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Local State
                                                              • Size 3KB
                                                              • SHA256 3eea9c9f6aea7a6155a67a75e3984529e4d3c89fa4eb773fad2ad30f56e1b87a
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Local State
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Local State
                                                              • Size 3KB
                                                              • SHA256 bfeb39108b78a74b6f1071763c47e2326ebca7b9931411cec94e389ece2f0f01
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Local State~RFe5b5ade.TMP
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\Local State~RFe5b5ade.TMP
                                                              • Size 1KB
                                                              • SHA256 509a10c45fb9be22951950f325fb5151d07aa5d7566d4af2c35bf5ad40e86eb7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              resources.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\User Data\models\runtime_artifacts\adblock_mfddibmblmbccpadfndgakiopmmhebop\bfe88f13e28902cfe6df1e9970a4a5b1\resources.json
                                                              • Size 937KB
                                                              • SHA256 cbcbf997fb4e1da02fd0be7e6ba3e4889a33ad376874fd58ba03d22a64e308aa
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              config.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\config.json
                                                              • Size 5KB
                                                              • SHA256 29c96114385b0db9d157c72f873c0490b058e09cc461415b48f9382c536f6675
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              features.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\features.json
                                                              • Size 1KB
                                                              • SHA256 268c804055872ef1112f67cccdf84dd60073c89dfd945bed313d7e6d8da492e2
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              install-info.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\install-info.json
                                                              • Size 705B
                                                              • SHA256 36f6913ae546633f1b688e3101a900ae7cd0d9c423a583e1562f03f82b977c86
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              server-settings.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\server-settings.json
                                                              • Size 2KB
                                                              • SHA256 ce88a72671c67f92b989f0d95a6d028c256f131049aebc153693caaeff27c7eb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              split-tests.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\split-tests.json
                                                              • Size 966B
                                                              • SHA256 44e12ed4996dddd47014cf5e58de59dfc9d901143ffc937045bfbc72e63da0d7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              substitutions.json
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\substitutions.json
                                                              • Size 2B
                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              144.3.2.222.manifest
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\144.3.2.222.manifest
                                                              • Size 221B
                                                              • SHA256 bf25eda7e030513500bc310ea49601dd205188179adf856f3fcceba8c0c7ee86
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              af.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\af.pak
                                                              • Size 529KB
                                                              • SHA256 369d7e007bae2f38364a4969c9d3459fea9dbac3e0e61872d8b1569a20ae8799
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              am.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\am.pak
                                                              • Size 818KB
                                                              • SHA256 9d599c98a33f2ab0480aa37c3c237321b5f2fb92628d330b688acdfc9fcfbfb9
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ar.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\ar.pak
                                                              • Size 902KB
                                                              • SHA256 c12a12e1bb9b2add60b079239e572af6db2e1db38807d60b580c7f2e930ad6bf
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              bg.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\bg.pak
                                                              • Size 929KB
                                                              • SHA256 a004db91e7ae93abb8bc87da89027f50dcc7a64ced3fd8532eba9354f6990746
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              bn.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\bn.pak
                                                              • Size 1.1MB
                                                              • SHA256 4ed282b39663c1c6446c9346b70ea1e20e0da450798826de9697a5125f218e89
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              ca.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\ca.pak
                                                              • Size 595KB
                                                              • SHA256 af1b880f234e271dac58aefa96aa695f8164ab0312254b46169e3b211d305b69
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              cs.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\cs.pak
                                                              • Size 601KB
                                                              • SHA256 8d9f352802f64ea3ee3499ad6f621c59071db692e1c8538a3b41745eb4ff10cd
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              da.pak
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\da.pak
                                                              • Size 556KB
                                                              • SHA256 49f0b0a0f6e95d13ce7a2f734621b9b1bdc632336618c601b293c0948378d5e2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              is-KV3SE.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\is-KV3SE.tmp
                                                              • Size 18B
                                                              • SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              is-U8JRM.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\Locales\is-U8JRM.tmp
                                                              • Size 1.2MB
                                                              • SHA256 05b419ac3aa7c12d75552bc8c3072aeb91dbf7727a69bc1bd053f1354990cb3f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              adblock.dll
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\adblock.dll
                                                              • Size 2.8MB
                                                              • SHA256 2c8375fe101ac501e5158eecf1a8373a11c78130658cb2242d4e19474c5032a3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              d3dcompiler_47.dll
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\d3dcompiler_47.dll
                                                              • Size 4.5MB
                                                              • SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              icudtl.dat
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\icudtl.dat
                                                              • Size 10.3MB
                                                              • SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libEGL.dll
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\libEGL.dll
                                                              • Size 484KB
                                                              • SHA256 c641c2013385cfe8e45fe29ec2a8dace8f32ff4eff24087787174e1eeff153e3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              libGLESv2.dll
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.2.222\libGLESv2.dll
                                                              • Size 7.5MB
                                                              • SHA256 6a02a9597fc76fb696e9c538016f1aa04e60623616cfe0b828ffe8c2f134dcd2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              shift.exe
                                                              • Path C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
                                                              • Size 3.6MB
                                                              • SHA256 3293a7514ff432ebbcb0df818fb046f975d4ae34c8b2ed4b2ca345396fbd19c4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              shift-manuals.ico
                                                              • Path C:\Users\Admin\AppData\Local\Shift\shift-manuals.ico
                                                              • Size 20KB
                                                              • SHA256 4f1e5c39cb6d291227e0d677697911d5f3efc873b82085a8346223c1c7619d53
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              button-11-light.png
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3JCJI.tmp\button-11-light.png
                                                              • Size 9KB
                                                              • SHA256 5f3b5ac5ef37b78b6ae95441da2f6245a807d80fcf943027493879c8f5264e78
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              button-rest.bmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3JCJI.tmp\button-rest.bmp
                                                              • Size 95KB
                                                              • SHA256 ed935c7ae961c73bd84916464149edfe2ed3f72d4443625e2d99ae7290db778b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              checkmark-11-light.png
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3JCJI.tmp\checkmark-11-light.png
                                                              • Size 369B
                                                              • SHA256 7999903171dedab53305b45b098d9adde30532d290616adb9dbec7d2d029bded
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              exit-11-light.png
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3JCJI.tmp\exit-11-light.png
                                                              • Size 6KB
                                                              • SHA256 086677bce7d245064b97e09c161fa84df9684c93de47eab9cface4890e5ebb0f
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              min-11-light.png
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-3JCJI.tmp\min-11-light.png
                                                              • Size 5KB
                                                              • SHA256 fef9a507556a330f457eac557c0f430c8993de5b61638c455a3f4311b0bd47a3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Win32Library.dll
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-783SS.tmp\Win32Library.dll
                                                              • Size 49KB
                                                              • SHA256 92af9d054e3b5dc9f472ff9534060d1c70e2ac77f768ae9e5029e29fcd606198
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              en.json
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-783SS.tmp\en.json
                                                              • Size 949B
                                                              • SHA256 0a720326db88c17a1b0198fd1756311be1cf61a2d2d616232b133c7b94a26883
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              exit-pressed.bmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-783SS.tmp\exit-pressed.bmp
                                                              • Size 24KB
                                                              • SHA256 2506e3e31e91b1a17aa46f7c59a7e30ffe8ea9d796c4243a226b63088ad0e20e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              shift-manuals.png
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-783SS.tmp\shift-manuals.png
                                                              • Size 27KB
                                                              • SHA256 28495c6a5f3ab802227f1459e30971d61b8c02df319b16306492f8df25c963e2
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              shift.png
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-783SS.tmp\shift.png
                                                              • Size 134KB
                                                              • SHA256 a1d2c48437058f24a5ea85c323469473ac4430198770794522a32c28783aadb7
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              Shift - Manuals_xl68w5.tmp
                                                              • Path C:\Users\Admin\AppData\Local\Temp\is-NUNOM.tmp\Shift - Manuals_xl68w5.tmp
                                                              • Size 3.9MB
                                                              • SHA256 fe3fcbdab74116490fa9c140ce61bd02ea4279ae835995db07bb2f562f7df895
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              content_new.js
                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3452_2124737027\CRX_INSTALL\content_new.js
                                                              • Size 10KB
                                                              • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              default.exc
                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                              • Size 2B
                                                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              Manuals App by Shift.lnk
                                                              • Path C:\Users\Admin\Desktop\Manuals App by Shift.lnk
                                                              • Size 2KB
                                                              • SHA256 7bcb8a2c5a0271db601f6c8b7dff546d4f4583d80f7255653792864c548c61bb
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              Shift Browser.lnk
                                                              • Path C:\Users\Admin\Desktop\Shift Browser.lnk
                                                              • Size 1KB
                                                              • SHA256 dc65ebcf96a9c7d4ae3a683b7dfb0b9de6dac1cf9977d97dc5b2bdc59501a224
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              memory/1116-1002-0x0000000000590000-0x0000000000987000-memory.dmp
                                                              Download

                                                              memory/1116-404-0x0000000003A00000-0x0000000003B40000-memory.dmp
                                                              Download

                                                              memory/1116-403-0x0000000003A00000-0x0000000003B40000-memory.dmp
                                                              Download

                                                              memory/1116-1232-0x0000000000590000-0x0000000000987000-memory.dmp
                                                              Download

                                                              memory/1116-338-0x0000000006AA0000-0x0000000006AB4000-memory.dmp
                                                              Download

                                                              memory/1116-339-0x000000006F560000-0x000000006F574000-memory.dmp
                                                              Download

                                                              memory/1116-341-0x0000000003A00000-0x0000000003B40000-memory.dmp
                                                              Download

                                                              memory/1116-1142-0x0000000000590000-0x0000000000987000-memory.dmp
                                                              Download

                                                              memory/1116-1487-0x0000000000590000-0x0000000000987000-memory.dmp
                                                              Download

                                                              memory/1116-342-0x0000000003A00000-0x0000000003B40000-memory.dmp
                                                              Download

                                                              memory/1896-286-0x00000000006C0000-0x00000000007F8000-memory.dmp
                                                              Download

                                                              memory/1896-304-0x00000000006C0000-0x00000000007F8000-memory.dmp
                                                              Download

                                                              memory/1896-1630-0x00000000006C0000-0x00000000007F8000-memory.dmp
                                                              Download

                                                              memory/2016-119-0x000001CC81DF0000-0x000001CC81EF0000-memory.dmp
                                                              Download

                                                              memory/2016-109-0x000001CC801E0000-0x000001CC802E0000-memory.dmp
                                                              Download

                                                              memory/2016-267-0x000001CC978E0000-0x000001CC97B7E000-memory.dmp
                                                              Download

                                                              memory/2016-120-0x000001CC81C10000-0x000001CC81C30000-memory.dmp
                                                              Download

                                                              memory/2016-118-0x000001CC819C0000-0x000001CC819E0000-memory.dmp
                                                              Download

                                                              memory/2016-155-0x000001CC940C0000-0x000001CC940E0000-memory.dmp
                                                              Download

                                                              memory/2136-1475-0x00007FFD63BC0000-0x00007FFD63BC1000-memory.dmp
                                                              Download

                                                              memory/2964-60-0x00000000006C0000-0x00000000007F8000-memory.dmp
                                                              Download

                                                              memory/2964-0-0x00000000006C0000-0x00000000007F8000-memory.dmp
                                                              Download

                                                              memory/2964-422-0x00000000006C0000-0x00000000007F8000-memory.dmp
                                                              Download

                                                              memory/3136-1499-0x00007FFD63BC0000-0x00007FFD63BC1000-memory.dmp
                                                              Download

                                                              memory/3176-270-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-29-0x00000000094D0000-0x0000000009562000-memory.dmp
                                                              Download

                                                              memory/3176-6-0x0000000002E10000-0x0000000002E11000-memory.dmp
                                                              Download

                                                              memory/3176-19-0x0000000004040000-0x0000000004050000-memory.dmp
                                                              Download

                                                              memory/3176-20-0x00000000739B2000-0x00000000739B3000-memory.dmp
                                                              Download

                                                              memory/3176-271-0x0000000002ED0000-0x0000000003010000-memory.dmp
                                                              Download

                                                              memory/3176-273-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-89-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-87-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-85-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-280-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-83-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-283-0x0000000002ED0000-0x0000000003010000-memory.dmp
                                                              Download

                                                              memory/3176-303-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-63-0x00000000739A0000-0x000000007415C000-memory.dmp
                                                              Download

                                                              memory/3176-62-0x00000000739B2000-0x00000000739B3000-memory.dmp
                                                              Download

                                                              memory/3176-61-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-24-0x0000000009400000-0x0000000009414000-memory.dmp
                                                              Download

                                                              memory/3176-59-0x0000000002E10000-0x0000000002E11000-memory.dmp
                                                              Download

                                                              memory/3176-58-0x0000000003EF0000-0x0000000004030000-memory.dmp
                                                              Download

                                                              memory/3176-57-0x00000000739A0000-0x000000007415C000-memory.dmp
                                                              Download

                                                              memory/3176-56-0x0000000003EF0000-0x0000000004030000-memory.dmp
                                                              Download

                                                              memory/3176-55-0x0000000003EF0000-0x0000000004030000-memory.dmp
                                                              Download

                                                              memory/3176-25-0x00000000750A0000-0x00000000750B4000-memory.dmp
                                                              Download

                                                              memory/3176-406-0x00000000739A0000-0x000000007415C000-memory.dmp
                                                              Download

                                                              memory/3176-228-0x00000000007F0000-0x0000000000BE7000-memory.dmp
                                                              Download

                                                              memory/3176-27-0x0000000003EF0000-0x0000000004030000-memory.dmp
                                                              Download

                                                              memory/3196-313-0x00000000007F0000-0x0000000000928000-memory.dmp
                                                              Download

                                                              memory/3196-1522-0x00000000007F0000-0x0000000000928000-memory.dmp
                                                              Download

                                                              memory/3196-1001-0x00000000007F0000-0x0000000000928000-memory.dmp
                                                              Download

                                                              memory/5372-305-0x00000000004C0000-0x00000000008B7000-memory.dmp
                                                              Download

                                                              memory/5372-1629-0x00000000004C0000-0x00000000008B7000-memory.dmp
                                                              Download

                                                              memory/5372-544-0x00000000004C0000-0x00000000008B7000-memory.dmp
                                                              Download

                                                              memory/5992-268-0x00000146A8020000-0x00000146A82BE000-memory.dmp
                                                              Download