0d9a85781ccd6f05749f761ada7211e37a99b5490ff9bf3e829e64c4cbe20c74

Analysis

max time kernel
149s
max time network
162s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Shift - PDF_x29rd7.exe
Size 8.5MB
Sample260722-pnlb2avdjb
SHA256 0d9a85781ccd6f05749f761ada7211e37a99b5490ff9bf3e829e64c4cbe20c74
MD5 ff21b1094a0214a22abd655219413164
SHA1 2af48d43c705d813759bd83f935ddfb2117e3aa3
SHA512 ef037b171205eed2de8fb761fe8e61e5fc1085dcd0ce13b16cdc64ef775b5b072e236c0a2ec116dfb6020d9e3f7a7d1b66ed1ac5f66e1a2dcf297d8556021846
SSDEEP 196608:PDbBa7UnIsJj7brIeR28TQzTAyiq+0M/h3iH/bw38G4tXK:PDta4nIsJ/brLU8czcxV1ifc3z4
TLSH
T19D962323724E673EE47A4A365972AA14853FAA10641F8CB386E44E4CDF2D0901E7FF57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution installer persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
14	4136	Shift - PDF_x29rd7.tmp

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 4 IoCs

pid	Process
4136	Shift - PDF_x29rd7.tmp
5288	Shift - PDF_x29rd7.tmp
1460	Shift Setup_x29rd7.exe
1396	Shift Setup_x29rd7.tmp

Loads dropped DLL 7 IoCs

pid	Process
4136	Shift - PDF_x29rd7.tmp
4136	Shift - PDF_x29rd7.tmp
4136	Shift - PDF_x29rd7.tmp
5288	Shift - PDF_x29rd7.tmp
1396	Shift Setup_x29rd7.tmp
1396	Shift Setup_x29rd7.tmp
1396	Shift Setup_x29rd7.tmp

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
844	icacls.exe
1828	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift - PDF_x29rd7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift - PDF_x29rd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift - PDF_x29rd7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift Setup_x29rd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift Setup_x29rd7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shift - PDF_x29rd7.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5372	shift.exe

Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5168-0-0x0000000000CD0000-0x0000000000E08000-memory.dmp	innosetup
behavioral2/memory/5168-15-0x0000000000CD0000-0x0000000000E08000-memory.dmp	innosetup
behavioral2/memory/5208-76-0x0000000000CD0000-0x0000000000E08000-memory.dmp	innosetup
behavioral2/memory/5208-94-0x0000000000CD0000-0x0000000000E08000-memory.dmp	innosetup
behavioral2/memory/1460-103-0x0000000000CE0000-0x0000000000E18000-memory.dmp	innosetup
behavioral2/memory/1460-121-0x0000000000CE0000-0x0000000000E18000-memory.dmp	innosetup
behavioral2/memory/5168-229-0x0000000000CD0000-0x0000000000E08000-memory.dmp	innosetup

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\DefaultIcon	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\shell\open\command	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{E797BF82-EFC0-4B94-A059-AA797B10D29C}\LocalServer32	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Application\ApplicationName = "Shift Browser"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Application\AppUserModelId = "Shift.Browser"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{E797BF82-EFC0-4B94-A059-AA797B10D29C}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\144.3.805.305\\notification_helper.exe\""	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Application\ApplicationDescription = "Access the Internet"	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Shell\open\Command	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Application\AppUserModelId = "Shift.Browser"	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Shell\open\Command	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Shell\open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe\" -- \"%1\""	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Application\ApplicationCompany = "Shift Technologies Inc."	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe,0"	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\shell	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe\" \"%1\""	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{E797BF82-EFC0-4B94-A059-AA797B10D29C}	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{E797BF82-EFC0-4B94-A059-AA797B10D29C}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\144.3.805.305\\notification_helper.exe"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe,0"	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Shell\open	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Application\ApplicationCompany = "Shift Technologies Inc."	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Application\ApplicationIcon = "C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe,0"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe,0"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Shell\open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe\" -- \"%1\""	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Application	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Application\ApplicationDescription = "Access the Internet"	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\DefaultIcon	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Shell	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\shell\open	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\DefaultIcon	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Application\ApplicationName = "Shift Browser"	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Shell	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\Shell\open	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\ = "URL:shift-browser Protocol"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftPDF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Shift\\chromium\\shift.exe,0"	Shift Setup_x29rd7.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\shift-browser\URL Protocol	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML	Shift Setup_x29rd7.tmp
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\ShiftHTML\Application	Shift Setup_x29rd7.tmp

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	20	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	Shift Setup_x29rd7.tmp
1396	Shift Setup_x29rd7.tmp

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4136	Shift - PDF_x29rd7.tmp
1396	Shift Setup_x29rd7.tmp

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 4136	5168	Shift - PDF_x29rd7.exe	89
PID 4136 wrote to memory of 5208	4136	Shift - PDF_x29rd7.tmp	91
PID 5208 wrote to memory of 5288	5208	Shift - PDF_x29rd7.exe	92
PID 5288 wrote to memory of 1460	5288	Shift - PDF_x29rd7.tmp	93
PID 1460 wrote to memory of 1396	1460	Shift Setup_x29rd7.exe	94
PID 1396 wrote to memory of 6120	1396	Shift Setup_x29rd7.tmp	95
PID 1396 wrote to memory of 844	1396	Shift Setup_x29rd7.tmp	98
PID 1396 wrote to memory of 1828	1396	Shift Setup_x29rd7.tmp	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x29rd7.exe
"C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x29rd7.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Users\Admin\AppData\Local\Temp\is-EOIC7.tmp\Shift - PDF_x29rd7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-EOIC7.tmp\Shift - PDF_x29rd7.tmp" /SL5="$400A0,7452306,1214464,C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x29rd7.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x29rd7.exe
    "C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x29rd7.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxNDczMTg0OSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyMiIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDUtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDcyMzk5OCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JMmVILTA4bmxsUU1WeEtCOEJoMEdnU0NhRUFFWUFTQUFFZ0lsZGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWRlIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjcxYWE3Y2QzLTYzMzItNGQwMy1hM2MxLWM3ZGJiZDg0NzAzYSIsImxhbmciOiJkZSIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg0NzIzNjE1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0NC4zLjgwNS4zMDUiLCJhdHRyaWJ1dGlvbl9rZXkiOiJ4MjlyZDciLCJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlfQ== /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NjQ4OF9hbWF6b25fbW9uZXRpemVkX3ByZXBpbm5lZCI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxNDA2OV9wbWZfb3JnYW5pemVyX3hsX29tbmlib3giOnsidmFsdWUiOiJ2YXJpYXRpb24yIiwicmVwbGFjZW1lbnRzIjp7ImJyb3dzZXJfbGF5b3V0X3RlbXBsYXRlIjoicG1mLW9yZ2FuaXplci14bC1vbW5pYm94LXRhYnMifX0sInNwbGl0X3N0MTQwMzdfcHJvbXB0X3Bpbl90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQzMzdfc3Q0MzM4X29wZW5fdmlzaXRlZF9zaXRlc19pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyOTQxX29tbmlib3hfcGxhY2Vob2xkZXJfdGV4dCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q1NjU0X3JlZ3VsYXJfdnNfc2ltcGxpZmllZF9hcHBfdmlldyI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMjM2X3Bpbl9wcm9maWxlX2FwcF90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEzOTFfZG9udF9pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDkzMTlfM3dheV9vbW5pYm94X2ZvY3VzIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDU1ODJfcGlsaWhfcHJpbWFyeV9tb25pdG9yIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDU3M19pbXByb3ZlX2JyaW5nX3RvX2ZvcmVncm91bmQiOnsidmFsdWUiOiJ2YXJpYXRpb24yIn19LCJhdHRyaWJ1dGlvbl9zcGxpdF90ZXN0cyI6e30sImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\is-6ETPI.tmp\Shift - PDF_x29rd7.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6ETPI.tmp\Shift - PDF_x29rd7.tmp" /SL5="$8022E,7452306,1214464,C:\Users\Admin\AppData\Local\Temp\Shift - PDF_x29rd7.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxNDczMTg0OSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyMiIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDUtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDcyMzk5OCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JMmVILTA4bmxsUU1WeEtCOEJoMEdnU0NhRUFFWUFTQUFFZ0lsZGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWRlIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjcxYWE3Y2QzLTYzMzItNGQwMy1hM2MxLWM3ZGJiZDg0NzAzYSIsImxhbmciOiJkZSIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg0NzIzNjE1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0NC4zLjgwNS4zMDUiLCJhdHRyaWJ1dGlvbl9rZXkiOiJ4MjlyZDciLCJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlfQ== /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NjQ4OF9hbWF6b25fbW9uZXRpemVkX3ByZXBpbm5lZCI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxNDA2OV9wbWZfb3JnYW5pemVyX3hsX29tbmlib3giOnsidmFsdWUiOiJ2YXJpYXRpb24yIiwicmVwbGFjZW1lbnRzIjp7ImJyb3dzZXJfbGF5b3V0X3RlbXBsYXRlIjoicG1mLW9yZ2FuaXplci14bC1vbW5pYm94LXRhYnMifX0sInNwbGl0X3N0MTQwMzdfcHJvbXB0X3Bpbl90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQzMzdfc3Q0MzM4X29wZW5fdmlzaXRlZF9zaXRlc19pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyOTQxX29tbmlib3hfcGxhY2Vob2xkZXJfdGV4dCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q1NjU0X3JlZ3VsYXJfdnNfc2ltcGxpZmllZF9hcHBfdmlldyI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMjM2X3Bpbl9wcm9maWxlX2FwcF90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEzOTFfZG9udF9pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDkzMTlfM3dheV9vbW5pYm94X2ZvY3VzIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDU1ODJfcGlsaWhfcHJpbWFyeV9tb25pdG9yIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDU3M19pbXByb3ZlX2JyaW5nX3RvX2ZvcmVncm91bmQiOnsidmFsdWUiOiJ2YXJpYXRpb24yIn19LCJhdHRyaWJ1dGlvbl9zcGxpdF90ZXN0cyI6e30sImVuY29kZWRfc3BsaXRzIjoiMDAwIn0= /LAUNCHER /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Shift Setup_x29rd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Shift Setup_x29rd7.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxNDczMTg0OSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyMiIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDUtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDcyMzk5OCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JMmVILTA4bmxsUU1WeEtCOEJoMEdnU0NhRUFFWUFTQUFFZ0lsZGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWRlIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjcxYWE3Y2QzLTYzMzItNGQwMy1hM2MxLWM3ZGJiZDg0NzAzYSIsImxhbmciOiJkZSIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg0NzIzNjE1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0NC4zLjgwNS4zMDUiLCJhdHRyaWJ1dGlvbl9rZXkiOiJ4MjlyZDciLCJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlfQ== /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NjQ4OF9hbWF6b25fbW9uZXRpemVkX3ByZXBpbm5lZCI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxNDA2OV9wbWZfb3JnYW5pemVyX3hsX29tbmlib3giOnsidmFsdWUiOiJ2YXJpYXRpb24yIiwicmVwbGFjZW1lbnRzIjp7ImJyb3dzZXJfbGF5b3V0X3RlbXBsYXRlIjoicG1mLW9yZ2FuaXplci14bC1vbW5pYm94LXRhYnMifX0sInNwbGl0X3N0MTQwMzdfcHJvbXB0X3Bpbl90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQzMzdfc3Q0MzM4X29wZW5fdmlzaXRlZF9zaXRlc19pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyOTQxX29tbmlib3hfcGxhY2Vob2xkZXJfdGV4dCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q1NjU0X3JlZ3VsYXJfdnNfc2ltcGxpZmllZF9hcHBfdmlldyI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMjM2X3Bpbl9wcm9maWxlX2FwcF90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEzOTFfZG9udF9pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDkzMTlfM3dheV9vbW5pYm94X2ZvY3VzIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDU1ODJfcGlsaWhfcHJpbWFyeV9tb25pdG9yIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDU3M19pbXByb3ZlX2JyaW5nX3RvX2ZvcmVncm91bmQiOnsidmFsdWUiOiJ2YXJpYXRpb24yIn19LCJhdHRyaWJ1dGlvbl9zcGxpdF90ZXN0cyI6e30sImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\is-CHUGT.tmp\Shift Setup_x29rd7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-CHUGT.tmp\Shift Setup_x29rd7.tmp" /SL5="$B0082,172438617,1214464,C:\Users\Admin\AppData\Local\Temp\Shift Setup_x29rd7.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxNDczMTg0OSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyMiIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDUtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDcyMzk5OCIsImdjbGlkIjoiRUFJYUlRb2JDaE1JMmVILTA4bmxsUU1WeEtCOEJoMEdnU0NhRUFFWUFTQUFFZ0lsZGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWRlIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjcxYWE3Y2QzLTYzMzItNGQwMy1hM2MxLWM3ZGJiZDg0NzAzYSIsImxhbmciOiJkZSIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg0NzIzNjE1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0NC4zLjgwNS4zMDUiLCJhdHRyaWJ1dGlvbl9rZXkiOiJ4MjlyZDciLCJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlfQ== /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7InNwbGl0X3N0NjQ4OF9hbWF6b25fbW9uZXRpemVkX3ByZXBpbm5lZCI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxNDA2OV9wbWZfb3JnYW5pemVyX3hsX29tbmlib3giOnsidmFsdWUiOiJ2YXJpYXRpb24yIiwicmVwbGFjZW1lbnRzIjp7ImJyb3dzZXJfbGF5b3V0X3RlbXBsYXRlIjoicG1mLW9yZ2FuaXplci14bC1vbW5pYm94LXRhYnMifX0sInNwbGl0X3N0MTQwMzdfcHJvbXB0X3Bpbl90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDQzMzdfc3Q0MzM4X29wZW5fdmlzaXRlZF9zaXRlc19pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDEyOTQxX29tbmlib3hfcGxhY2Vob2xkZXJfdGV4dCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q1NjU0X3JlZ3VsYXJfdnNfc2ltcGxpZmllZF9hcHBfdmlldyI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUwNjNfYnJpbmdfdG9fZm9yZWdyb3VuZF9tYXhpbWl6ZWQiOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1MTExX3BpbGloX2xpbWl0ZXJfb25fdW5sb2NrIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDYxMjVfYWx0ZXJuYXRlX2Rvd25sb2FkX2NkbiI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3QxMjM2X3Bpbl9wcm9maWxlX2FwcF90b190YXNrYmFyIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEzOTFfZG9udF9pbXBvcnRfaGlzdG9yeSI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDkzMTlfM3dheV9vbW5pYm94X2ZvY3VzIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDU1ODJfcGlsaWhfcHJpbWFyeV9tb25pdG9yIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDU3M19pbXByb3ZlX2JyaW5nX3RvX2ZvcmVncm91bmQiOnsidmFsdWUiOiJ2YXJpYXRpb24yIn19LCJhdHRyaWJ1dGlvbl9zcGxpdF90ZXN0cyI6e30sImVuY29kZWRfc3BsaXRzIjoiMDAwIn0=
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /delete /tn ShiftLaunchTask /f
        7⤵
        
        PID:6120
        
        C:\Windows\system32\icacls.exe
        
        "icacls" "C:\Users\Admin\AppData\Local\Shift\chromium" /grant *S-1-15-3-1024-3424233489-972189580-2057154623-747635277-1604371224-316187997-3786583170-1043257646:(OI)(CI)(RX) /t
        7⤵
        Modifies file permissions
        
        PID:844
        
        C:\Windows\system32\icacls.exe
        
        "icacls" "C:\Users\Admin\AppData\Local\Shift\chromium" /grant *S-1-15-3-1024-2302894289-466761758-1166120688-1039016420-2430351297-4240214049-4028510897-3317428798:(OI)(CI)(RX) /t
        7⤵
        Modifies file permissions
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe"
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=144.3.805.305 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8530ef70,0x7fff8530ef7c,0x7fff8530ef88
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1856,i,3172540023053319024,12296875019866595026,262144 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1948 /prefetch:2
        8⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --subproc-heap-profiling --metrics-shmem-handle=2320,i,2777203808962171229,6185567460763355834,524288 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2364 /prefetch:11
        8⤵
        System Time Discovery
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2512,i,15467967064778382744,17977542388386806902,524288 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2680 /prefetch:13
        8⤵
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3684,i,607385104313636315,11472230112487417297,2097152 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3708 /prefetch:9
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=3604,i,5205854767268376328,1876336915657289782,524288 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3660 /prefetch:14
        8⤵
        
        PID:5284
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" https://app.shift.com/pdf/thanks?lang=de&data=eyJhZF9ibG9ja2VyX2RldGVjdGVkIjpmYWxzZSwiYXR0cmlidXRpb25fa2V5IjoieDI5cmQ3IiwiZGVmYXVsdF9icm93c2VyIjoiTWljcm9zb2Z0IEVkZ2UiLCJkaXN0aW5jdF9pZCI6IjcxYWE3Y2QzLTYzMzItNGQwMy1hM2MxLWM3ZGJiZDg0NzAzYSIsImdhZF9jYW1wYWlnbmlkIjoiMjI1MTQ3MjM5OTgiLCJnYWRfc291cmNlIjoiNSIsImdjbGlkIjoiRUFJYUlRb2JDaE1JMmVILTA4bmxsUU1WeEtCOEJoMEdnU0NhRUFFWUFTQUFFZ0lsZGZEX0J3RSIsImluaXRpYWxfdmVyc2lvbiI6IjE0NC4zLjgwNS4zMDUiLCJpbnN0YWxsX3RpbWUiOjE3ODQ3MjM2MTUsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDUtd2ViLmV4ZSIsImxhbmciOiJkZSIsImxwX3VybCI6Imh0dHBzOi8vYXBwLnNoaWZ0LmNvbS9wZGYvMSIsIm5vX3NwbGl0IjpmYWxzZSwicHJvZmlsZSI6InNoaWZ0LXBkZiIsInByb2ZpbGVfaWQiOjEwOCwic3BsaXQiOiJiIiwic3BsaXQyIjoiYiIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWRlIiwidWEiOiJlZGdlIiwidXRtX2NhbXBhaWduIjoiMjI1MTQ3MzE4NDkiLCJ1dG1fY29udGVudCI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fc291cmNlIjoib2gtcG1heCIsInV0bV90ZXJtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyMiIsIndoaXRlbGFiZWwiOiJwZGYifQ==
        8⤵
        
        PID:2192
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=c:\program files (x86)\microsoft\edge\application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff8422c188,0x7fff8422c194,0x7fff8422c1a0
        9⤵
        
        PID:5364
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2108,i,10430015445702277622,15654462471112770382,262144 --field-trial-handle=3140,i,4468133686360916555,4750075960920252048,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:2
        9⤵
        
        PID:3456
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,859286577626674723,17237546988445881401,524288 --field-trial-handle=3140,i,4468133686360916555,4750075960920252048,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:13
        9⤵
        
        PID:2528
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3675885563662218095,17770392102620550246,2097152 --field-trial-handle=3140,i,4468133686360916555,4750075960920252048,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
        9⤵
        
        PID:5956
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4032,i,113744538126990915,2580911850135774931,524288 --field-trial-handle=3140,i,4468133686360916555,4750075960920252048,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
        9⤵
        
        PID:3720
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12542840799513955090,4258760502605297828,524288 --field-trial-handle=3140,i,4468133686360916555,4750075960920252048,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
        9⤵
        
        PID:5396
        
        \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
        
        "c:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,15327277325122403076,3005913693068375482,524288 --field-trial-handle=3140,i,4468133686360916555,4750075960920252048,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        9⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4484,i,5686907084632687964,179403191163967609,2097152 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4528 /prefetch:1
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
        
        "C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5568,i,8537884269896094986,11297469129790968189,2097152 --field-trial-handle=1980,i,10910536867075882186,999084506036325068,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5576 /prefetch:1
        8⤵
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\delete_is-UQRG5.tmp.bat""
        7⤵
        Executes a command shell one-liner
        
        PID:844

C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
"C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
1⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3440

C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
"C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe"
1⤵
PID:3360
- C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
  C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Shift\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=144.3.805.305 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8530ef70,0x7fff8530ef7c,0x7fff8530ef88
  2⤵
  PID:948
- - C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
    C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Shift\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=144.3.805.305 --initial-client-data=0x15c,0x160,0x164,0x138,0x168,0x7ff698e8be38,0x7ff698e8be44,0x7ff698e8be50
    3⤵
    PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fc1ad7194d0aabfca0ca2fffce744d2bf0134c2efd577afdfbcfdcaea33e4f66
MD5 3f6b9d94c78a77063ae3892725934a97
SHA1 3f0e2797a91cd1690feba9d35c1d12a7ddb92873
SHA512 445f1601eaefd060d9db5d5d8176d2361052bf21e1be47511ece4712c33abee11680223fdbaf4eb9daf6b803ba7625391930e1f4d7133565c38cb3a520eb3feb
SSDEEP 768:6rv+4UNbds38LDZIO0NQNzc4ReyIsXweVH1S5D:6bsbS3Etc44bsgEH1Y
TLSH
T16E03CF32EC688977ACF66786B54B76133EF8912782D81E90C5DD6F0C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32994b32-45dd-4af0-9b83-31467de1eef1.tmp

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\32994b32-45dd-4af0-9b83-31467de1eef1.tmp
Size 199KB
SHA256 d5b9a0bce0d3852b521362d929b1d263435024af37b1a0b268522867d7f82069
MD5 7631e052c956d1b7b6d82a4b77e07b32
SHA1 3fb8c065a5958530aefe557fb948b7763d490bc5
SHA512 8ff112b01ff881c5a9979ba680ac4eb1e2268cb7018151869531e2b311e08a6bb94d38f9d7b955fa5b527a6899b96f6d23949a48fbe6c4806acd0c05c03f82b9
SSDEEP 6144:GCau10mmV5Gh3EX/4pSrA67ad01A+z8TNsaXi4:G+10mt3EXApSrA6pz0NLXi4
TLSH
T14614B0E57277CB0EC3A618B472F1D36212ACA3D9D55B064393F2DB2D269EDCD8318192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Shift\User Data\Local State
Size 3KB
SHA256 130d7877009045ce7023df248e82e9d5902f95b7d6a84a9775160440ee7c5432
MD5 f0b6ae21a61b0c772b3c55ff6252c4f8
SHA1 ec0bfdebbb1048a90c599e8123ce8fd62cdc0890
SHA512 7ffc5d68b83a3ae789649b7dce38e5f5dfbddfba1cb2afd13040e8d07bed1cb115b47d7d3492da41fd7dc8c6e6d1783a74f54ae8ecc684b01936e73b19523a64
TLSH
T1FD61C72AA8A5DA7378779596BA427A03DA759037D2B2A9D4E5FC0B0C05F79DC3303413
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5be79d.TMP

Path C:\Users\Admin\AppData\Local\Shift\User Data\Local State~RFe5be79d.TMP
Size 1KB
SHA256 b7800d68a81fbc46e19c6d54825949c8f6406e563e9733b2f999e1d4fc929dfe
MD5 bb8044615bb3c39ae9b06a26ac500725
SHA1 0cffb3a41be7b9e0b4055fe1cab83de40b6dc5ce
SHA512 f2666b14c6042ec5299be36cee5b1420fda777b50a89d99075341c4793bcc61cfbe7a75ecea892295b5e9f957cf862b53efd29f970b5fef26c1e3d391ddf235e
TLSH
T1942189B3B858EA73BD1839D2729265932D22D13653714540B1FE430803F79DC3617C32
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\config.json
Size 4KB
SHA256 244f943bab3a324075a28537b0f514c479af8d099e144b17df981a212280062a
MD5 816a1745312af5ccb33d89a64c6758f2
SHA1 45ce0877f7facaa601301db1aeae4b46fa281d2b
SHA512 c22eb7c43cdd9ee2ed1110dddc899248618d521d3aa0fe361f7aec4539559235ca85b6ceab2417a3c52a2e4467d74b71a6e2d719fc54d18920131f2bd490ae9d
SSDEEP 48:YB72ZqWg9gMyAnyb9gfg9g8lye94sy+8yx94RFgmGfWg9gDgyZaobEl9Nif9G6bu:8DKQ1G4TBezSkdWcEFawJan4XukaxL
TLSH
T129B1856311281DF36369D2A8C909B01B6439D4BBAC8478AE75F4D91C193FEAF132753B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

features.json

Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\features.json
Size 1KB
SHA256 0c04324a944942c7e0466b3a729fc45ce7021640bbb81b17313d32001945b0e1
MD5 6fcadf774ae2e6095e08da5665c5cde9
SHA1 d9339c52af2406d7f9fc5326c47dc18d1d49098f
SHA512 42bd181534b1543b540b8a8964b66fdbeb7f406f4095e56869e56f378bcb0e4a0b74576919e9f4008457ebd9bf4e283d55938b34c290df7f6a1e6d6701efe61a
TLSH
T1FD21F358421A32FE85D8D2B6CA45BE176F3CCDB36104307AB15D041C24AF9BB0171937
MD5 SHA1 SHA512 TLSH

Submit Download

install-info.json

Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\install-info.json
Size 709B
SHA256 f37a3f9215ba45f340970e4f56e742708cabeb783f358156554ebcb20c364dc6
MD5 dd49a8a35f79cf529a0957b2713c864b
SHA1 71f1c1e747f21e925bfe93342a0a3117fe0b9f7a
SHA512 1e4b7f778f7cd3ce3bcef6ba031a9f2ec51fe7ce8d4a51f77ce290ddb712c7a282087e19631e2604b5b5711c3dafcbfbfbe5ef611f3d3308762901176e9fe960
TLSH
T1B301230705DA99B75B81B2DD014E3AE472D624BAF9812C04D5C5DC1C107762163DF54F
MD5 SHA1 SHA512 TLSH

Submit Download

server-settings.json

Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\server-settings.json
Size 2KB
SHA256 7c98e46683961b99ff210a27d119efa9c00aebaff15580754f04f808874100b7
MD5 7523ac91db6dace155d2ab2a49be2aa7
SHA1 03b309f36ea34a109677f0a07f0dab5b4e472b12
SHA512 5e0500524627b36563b71d041bb2321073e4e510e32086e6c6b8cc997edf14d82ee6cf5c9705fbc55676019fee7329aafcc84f20b3971852e1b77748a4cae781
TLSH
T1BC4115A3419C89327771A1E4584D711CB076204EEDCABCEB66F4ED0C4464B9B625F21E
MD5 SHA1 SHA512 TLSH

Submit Download

split-tests.json

Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\split-tests.json
Size 1KB
SHA256 31d3ffff9823c96929da28f319f7ad25549850839afa41aefdf95b9b2283e1e6
MD5 dc0d68b02e2891cd502f28739eb72756
SHA1 2a7e813b6a0860bad091b54ff1ffaf47930b779b
SHA512 bc0e0973143929cec768a1224e236012fb9aba4a3ba6f9af0e12f1cba43174c10f2a2f719496332a02e336dde1d9000726d19775c92589bec171dcc06028b737
TLSH
T148212692A8324DB72366964D225DF0266430DC5E8DF5098FDDF09FA56E50F8C23230B1
MD5 SHA1 SHA512 TLSH

Submit Download

substitutions.json

Path C:\Users\Admin\AppData\Local\Shift\chromium\.configurations\substitutions.json
Size 102B
SHA256 d0bbfcd75560ad7b7a7c2bf97fa971dafbee50d8ded2c17dd13f4b75e2c627c1
MD5 3c75ba331e7ff2cd8082e41a78af7458
SHA1 885ba2e2b19de58cc99722dc82cc73ebbd3b2896
SHA512 ea8dc26f969ee621f82593a9eb4fe9d19a26c2a6face66461c365c4d2204a51bf5190d13f96c8d51027d9685ebe8b91692ab036daf728efcf3069d7a9f617957
TLSH
T1ABB01243E01D4819F6F2B489967693C2DD34B1300DB93805E8BB7B45C56179C0237BC4
MD5 SHA1 SHA512 TLSH

Submit Download

144.3.805.305.manifest

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\144.3.805.305.manifest
Size 225B
SHA256 7b957a07ef2ae8b3c46ca0150d6d44ed54546bd2d314fc1512f4d3faebc11bb6
MD5 b443159a8b98d046cbce5f31fdc3377e
SHA1 0259f5ec23ca1ef038a0ba3045398ed2ee97f7c7
SHA512 1e2391ed9acd8b522ab7121d80b03502745a40131d96509fa088a42bdbe01905fa81b38a861a03c8bb2684597bfb8395a28c7c68543c5bb138e34c813aaf1bc8
TLSH
T173D0A9908989229DEF3240B03C9E702092A8E72304C8201D38FC782BBB9792491839B4
MD5 SHA1 SHA512 TLSH

Submit Download

af.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\af.pak
Size 529KB
SHA256 369d7e007bae2f38364a4969c9d3459fea9dbac3e0e61872d8b1569a20ae8799
MD5 d4d47f8b03584152516ab5203bcd6f0f
SHA1 523cea0b1ffdf0bf9538a843d82193be0df828be
SHA512 39365244482c8fafd89bac9185afac2a8adfaf460f24de2cdc731dd07a1ce0c5102674e335cb3551bae446e9bab908b0f2d7ee535dd109e09c4e367a77d5cf64
SSDEEP 12288:GG2yaCuvvON7ECQ6mU3NpTH2JynYX+atDALf4CozvQGp2Ff+nDvS2Aq2UxdDDr6N:GG2yaCuvvON7ECQ6hNpTH2JynYX+atDK
TLSH
T11CB42B0BE784233D05A03696BA0945B7FF5CA12CC775B2BAEDAD81350662EFC117E1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

am.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\am.pak
Size 818KB
SHA256 9d599c98a33f2ab0480aa37c3c237321b5f2fb92628d330b688acdfc9fcfbfb9
MD5 d8f73f9c7899841be6c8032fef6b9abc
SHA1 4ea66da837fb3586c0950150675c65377c7e7b69
SHA512 1e7ba1d65b14e3609d97d8ac67c19ae5926481e753c162312eb36343a842a5549a95d1d3340a044aa8ae941ba2d60befebeead1169737444c4102b87feb62157
SSDEEP 24576:QLIl+aC1zhTCK2yYex6MFdrYUzMyXIauKkMyFypyj:I4
TLSH
T10C05EC157EF9F7170F8E8A1994320E4EA5A4AD0652812C38D35AD3FC2B2DF1B4DDE219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ar.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\ar.pak
Size 902KB
SHA256 c12a12e1bb9b2add60b079239e572af6db2e1db38807d60b580c7f2e930ad6bf
MD5 6a5ada0e903fb94bd2e07c112dbe7796
SHA1 85f840234150e7fe31e043491947e8b60e2163ca
SHA512 b5b0e0100032dc8a6fd00bd5569cce973ac11424b1e9e0ab404107c58768ca2fd99a824548ed0ff56ff35aa4a883c4fc28d4d4ead61a1d17a90a96bb08014667
SSDEEP 12288:IiRUK81DB1aCeAGAtxwjdcZqpLkYYSE8NGzrFkbF:Iiv81PaC8
TLSH
T10515ACE21B2984720B92DF0ED1E2366CE972BD23DB4BFD3124934A2156D7513E74E638
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\bg.pak
Size 929KB
SHA256 a004db91e7ae93abb8bc87da89027f50dcc7a64ced3fd8532eba9354f6990746
MD5 c710f3a50dbfa5a19a2e26992a2b0047
SHA1 90cb40ebbc3708520a3d638311404ddc651476ac
SHA512 d35637e67ac5fa0ab07a16c2f5e71cdb514bdb7cdd6093b6323528dd78858e917f5b465c8b5d83b5fe0f811cabab14815fb573da2d60737cee520e6a78c85589
SSDEEP 24576:DyyKewaC7WSG+LYezQkECNUqVb6HDZuuV3GjKgUZVDXtxf7Qu2VxbQ9DjdE7QHjk:JhcWSG+LY7uUqVb6HDZu83GfUZVDXtxW
TLSH
T17B1555A15B9A649F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B887BA64D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bn.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\bn.pak
Size 1.1MB
SHA256 4ed282b39663c1c6446c9346b70ea1e20e0da450798826de9697a5125f218e89
MD5 1c303d2968afc51c09db196bb684c9bf
SHA1 4dac645fd18773a0c6b6fa1a5605951513b7c83b
SHA512 34f0f263e5ff603a1c629e18a7574b96766897961eac87325bbe4c95d979a5f85f8308a7aa61bb747a733af5f99f1a0571a5bf892460a102ed42c19f4341ce4e
SSDEEP 3072:6/io4Y3t03eqtuSF8I/H4ItHJU/aC1Mw8zWenC/8gBbl8vW3X:JY3tAtus/4IxCaC1D8zWenC/XBbF
TLSH
T1EF4523209C6E91B2A8C5DDC9434C6370C523AE9B9B61F74DDC17A14938ADC3C8CADDB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\ca.pak
Size 595KB
SHA256 af1b880f234e271dac58aefa96aa695f8164ab0312254b46169e3b211d305b69
MD5 55cee3df8fc941d9de8d3a0c8fb3590d
SHA1 38102c63c4b243f0f7bd5ef5efefeea1617f2f9f
SHA512 e8cb2ea5d5601e8c0789d9bcbcd73d10682fe22abb388f422a70d80ce8cabf0d919ffce3ac28f41ace88a34268becbd1140b634db14c3b2b2befda9bbd51fb9f
SSDEEP 12288:4OBw7RkaCPliVdZwNwWxnuZlWQB8wEI6d2H2D6wCpIqkzkXyr3TdGuwNMEvrGvXN:XaCiMrxg8bDMWBbOhsue
TLSH
T106D41A239BC83B7744D2330AFB46C257B49CA9847B07D294F4AE1A1A13C8ADCC777695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cs.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\cs.pak
Size 601KB
SHA256 8d9f352802f64ea3ee3499ad6f621c59071db692e1c8538a3b41745eb4ff10cd
MD5 05a6665add2ff2c62443a7601754b95f
SHA1 ec42b318edb0f7aac5c09cf5553b7a5e6b6c65c6
SHA512 97094f72b745ad160b31ce5648c469e78757a0c10180e292d4d1100a58567140c7f2ea5332729f524a2ec208ff63786e65ba5ecf2d0a6cd280adc724c75d5351
SSDEEP 6144:Js8dMJh/9kb00aCvPnz1QQPAWplcZGcMzJSBbl8QAss:JsiMTOaCXW2lcZGcCJS4
TLSH
T1CAD44B1FEB927426584012487BBE4128BD2EC314076FA5AB3C8F989526717BECFF5D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da.pak

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\da.pak
Size 556KB
SHA256 49f0b0a0f6e95d13ce7a2f734621b9b1bdc632336618c601b293c0948378d5e2
MD5 51b48d8b4a4f4fe0d1521e8bae8019a3
SHA1 776b8e4afc30c67fdd675f9576fe2f4f304ed812
SHA512 d558031c34c185fb05bad4febec2ba4a307c2c0fae17664622f7385b082be02950be9ecc8e4548575ea316014e6dc1ce377e0c3f9ee4d4c184526b9d37bd6fa6
SSDEEP 6144:og49ifshwzzVW/caC/Zxe4E2e7VEwDPQJw4bFYaOakLfXCHNQfwfzZhRo:o50bNaCMkeaATR
TLSH
T157C4394BDD5C732F89A90664F6118DA7EF6D903CC689124F74DC903D06DBDA093BE28A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-NVN4O.tmp

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\is-NVN4O.tmp
Size 18B
SHA256 ca73097bd968b363b7145e86b64f3c595e533808b0763dc8863a27fc363cfa51
MD5 65f69bd2d8b6458d3ecf77d84d70dc1c
SHA1 679bdfb03cbaa594ace5af4340a061ddc514309d
SHA512 39f2728a1898bc9406516fa737c58c349e3bd7f779276a2f6679b3e3f0db43f956e03ad25e5d9bf4b07b19909febcc6c0560f71ab4f4fa6b5dd1f021ef742c60
MD5 SHA1 SHA512

Submit Download

is-T73O7.tmp

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\Locales\is-T73O7.tmp
Size 1.2MB
SHA256 05b419ac3aa7c12d75552bc8c3072aeb91dbf7727a69bc1bd053f1354990cb3f
MD5 bd5e7bd5dc57bd6253b24ea3d266da56
SHA1 f3a648e94498ad3f140a18e3df2dcca1e344c57f
SHA512 d65f8cc4a2f370c0ffc792644833d3aa2731467680066eb91dea458486054739df89f0b9dd31cd7e6e5e7ae5b8557b430295ebc474734850296069e645ea78d9
SSDEEP 12288:x8V0z+yiJ7Zl8GxQ3MboEuJrZpWsDzKaWpxe8KzkoqilFJxiIB48Lk0egnkudkwP:AfW65y
TLSH
T1D355BD78293C225BEC585C89C068AD439AC20C53F57B6EF9F0DE72719FF25C20169D9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock.dll

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\adblock.dll
Size 2.8MB
SHA256 a4e9ca068908394aadb98369259ebd6713cae61f7ac69c40ddecec2e7e02d944
MD5 023acfcf114bec33993ea8ca3ffb4fa7
SHA1 86f4fa2d8b6f2f8a9333e1126f0c1ee1777bfc85
SHA512 aa29a90a4307f2952cae161470dfc4bb4df515b4d1388df77aa9170254ca0a8b7636d4eda60f5011795dab212a528e5cf53e0ccbf5a13409e0819e416342c550
SSDEEP 49152:hPcU5B8Iyt7+RUNS0U70t8PwfEA6YIootj12e7kDjXXM:hOvotj12DDjXXM
TLSH
T191D52812BE9659ADC19EC474824706721B32B4CA0B31BAFF11C45A393F6ABF01B7C759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\libEGL.dll
Size 484KB
SHA256 b0e19b4504d24cd4ecb7c57092534476fad87c57d26049d049adc3899c6789d6
MD5 a268896b92e975dbac6c034caaaeb42a
SHA1 3e26240e6d8257002251516e6ffdc10aef24ed2f
SHA512 f167a565a1dc2217ae8389c82784c0d0d96d08419831c91d3a7f11ec32948c8e666d9b3a4dca0a9f82e4f3653caaba98686f42e63b952ba4ed47a3c26ce3e9ee
SSDEEP 6144:fIqv3/orERgXzJycMpNTQLleN/XPYcKQznIxDsOW0L/LN:fLvAQKXzhMpUleN/XPYcK8nIxDsOT
TLSH
T1F1B48E15B3E845A8E47AC1348A538547EB7178460B21F6EF03E0E2792F7BBE45B7A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\Shift\chromium\144.3.805.305\libGLESv2.dll
Size 7.5MB
SHA256 45c0c7b12f5872f7a5825853ca9ce13c192de16ad0c1247db46779dbc959c8df
MD5 37ca53b18b9eb0af1ebe9f32369e027f
SHA1 ea7dec10a754e97bc1cd1a26d03f5af8a3218b5b
SHA512 ded099b011b5d33667560c308e5849008714418b51aa456b8ca321f2871ba565455160ddfc75850071391dd1b5ec66ce65157db1a87de7862795a967ff279604
SSDEEP 49152:1vuvAhZsTK9KqdzQPfZMi9aPPJdV8gmAn0YyH+q/c+OfeUxNn1Kbmr6jcFA5bFB0:kGsP9RvYy2Oo0RHS8Yx/qlkoI5NLw
TLSH
T1FF866C13F6A240D9C01DE2B89757A223F774B8450724B3CF2A9467162F76FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shift.exe

Path C:\Users\Admin\AppData\Local\Shift\chromium\shift.exe
Size 3.6MB
SHA256 3e2f56e1335a755dfd428357a8780601de6b9c435bfe3064f4cf3db2d3fe9f8c
MD5 4efedcffbaf0e59182708006f0c7d0b0
SHA1 71798e2149044def86b0a8d9a99d21d1fd5b045e
SHA512 8455673ef529e610c3888e36582de7ce9fd754280c5021deb66fb2659c0c5fcb0790c5aa05dd579acad4a15fc137a216dcce6b689a109a8d34d19f5e20b5f52d
SSDEEP 49152:rI/typGDZtps41UKxfj1N5Jh+0zn41smbA69kNsSy2J7CuHCuLCuf:rdGqontzcZsCECYC8
TLSH
T198066A13F19940D9C05AC078CF56A232AB65BC4C87F162EB3690B6D63A76EE07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shift - PDF_x29rd7.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-EOIC7.tmp\Shift - PDF_x29rd7.tmp
Size 3.9MB
SHA256 4ef2498ef032d0354ef8c4722438bbf9943d43f078e9de9b3c32a5bb16708e87
MD5 add93fb7fca95dbfe77404733257636f
SHA1 28e8f7767ce31b6bccbc85ac434968774621f16f
SHA512 a4d2120d5dbd2c64625c902900fda88b1608d1ab0b16393e4b2b71e6612ea7fe8400f84cc532c5f0e5c6b93c40e0ba789d8fcc27d85e8dca570bfd5e0fc1f87d
SSDEEP 49152:i44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70azpkfC333jAga4ESbhFjO:5IPp70wijepoGzgbAC333ta7SlFS
TLSH
T190167C13F389653ED06B1A3B683F9250583F767039178C579AEC3A4C8E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Win32Library.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RSPLB.tmp\Win32Library.dll
Size 49KB
SHA256 92af9d054e3b5dc9f472ff9534060d1c70e2ac77f768ae9e5029e29fcd606198
MD5 d82b30898c428a7dbee81cecea520f68
SHA1 af89fa7f560c6cb183a293860e2638615f5d2001
SHA512 c334edcb26275efd2fd9df4b68ccc874862e4b53cb13e2edac0c81e97bc6e9e1463ce938f4d74844fdad7d38ad29fc6aa5582a0b0b13eecffd8947685eb9f334
SSDEEP 768:t6lBHNrzbZJ7xxNuI9nD9nz7q19BS5q7RD/v/C:t6R3bDxffnD96TBpRzXC
TLSH
T19C336C02F7E45A30E6BF4B3D487A46484370F55A6927EB4E0EC2688E7DB77405990BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shift-pdf.png

Path C:\Users\Admin\AppData\Local\Temp\is-RSPLB.tmp\shift-pdf.png
Size 7KB
SHA256 c5ab6aea787bf9da9116554f93704d342e8214706904849d6fdb66856923e460
MD5 782bbbc3de0d4f7a1dcd812fcc490cba
SHA1 273256420ab3824e7a6ec74a1fb01f52ef5d7d63
SHA512 e2d8a3ac4c6aad0a71d5eb2f491d4c125ad683c2502a71e2debcfb2cd14875e1ac08ca0550c8cbc7e5b18e7bcd3cd5830ead597ecd12cab433cc4f84a5dc2a82
SSDEEP 192:4hBTAyVdPsncrm0O6n256PUNfHNGx3dZ1iZHAe9Ism:4htVlVOa40UVHNGx3dHoHAeaB
TLSH
T161F18DDFCFF049438879171A82FAFC16B0CA50A026674121AF1786EF7099867274DAB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shift.png

Path C:\Users\Admin\AppData\Local\Temp\is-RSPLB.tmp\shift.png
Size 134KB
SHA256 a1d2c48437058f24a5ea85c323469473ac4430198770794522a32c28783aadb7
MD5 0423d0589e58341b5b64c6099f4123b7
SHA1 4936c3104af415dd882caa94da80a8af600685c5
SHA512 2c1d63ab401ff6d12b1935ac04f8cb9de3afe63d03ee1c8f9103250ed21f41cdddee955f26b5b1395ea3d324073a2b1e0c6b03f024966297724dce3e3840e05a
SSDEEP 3072:bmN1G4sZna5sznfIoe+Q/0o3eQDq7Mzdi4bwe1RiTDPxrYGoa6S+Y:bmN1G4BsnfIym4QDqCx1cDJcGohS+Y
TLSH
T1D6D312BF3717FEFEC119082AD89A223DD2488455042F5BF325385568B32342E9E2B5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

checkmark-11-light.png

Path C:\Users\Admin\AppData\Local\Temp\is-UQRG5.tmp\checkmark-11-light.png
Size 369B
SHA256 7999903171dedab53305b45b098d9adde30532d290616adb9dbec7d2d029bded
MD5 45898d8f9f466da1b6f47ff21d3fed75
SHA1 6566135e7f8098b9eb12aac882e7a57cb64f39ff
SHA512 b4dc0d02a81f76fc507d28e427a844bf45c283b92c807d798cb09533ef9c3e69fafad089c7200b603c51fdf0f2b2d878b77abcc0334d9ed3bd7cfc3224508218
TLSH
T11DE0C0E1D8797DF1F399029F5572D021F559DE460D615004E7118476701FC484BE2E07
MD5 SHA1 SHA512 TLSH

Submit Download

de.json

Path C:\Users\Admin\AppData\Local\Temp\is-UQRG5.tmp\de.json
Size 470B
SHA256 544d13ca25eb71670a6352baf06b3345960a71a36885a28db6cb4270916c3b0b
MD5 93388bbf10862669d294ac5401c8f42a
SHA1 b287a9d016ea530da6dad563cfaaf8f9015af042
SHA512 f671f7241c0b903ac84244cab0b8803d39c3a247edc5e1f99e40cecd6baeb0f4b02f7ff1d991a80611b10d5ae5d7b0b342f6f6ce7709562b72f7f58185d8386b
TLSH
T161F020819671763394E2130616831B663022CF9B578E31185BCFA10C228FAF3A87732F
MD5 SHA1 SHA512 TLSH

Submit Download

en.json

Path C:\Users\Admin\AppData\Local\Temp\is-UQRG5.tmp\en.json
Size 949B
SHA256 0a720326db88c17a1b0198fd1756311be1cf61a2d2d616232b133c7b94a26883
MD5 30b05d08fcca5b9523e124dac387b164
SHA1 051b5f9a7ab0b72d7de0e525654585eb75537252
SHA512 23b7d83c200f7345af7259ab4e722ec46608f1147a15b707da2fe900e9e33ff0af5fe0b28e4d89435cfbc5a16164b0ea5825a047a945e77fa5b0ec72fe763d69
TLSH
T13211202DABB5D93378E5168B2D823A523538CE0F16EB344897979208224F95373BF35D
MD5 SHA1 SHA512 TLSH

Submit Download

exit-pressed.bmp

Path C:\Users\Admin\AppData\Local\Temp\is-UQRG5.tmp\exit-pressed.bmp
Size 24KB
SHA256 2506e3e31e91b1a17aa46f7c59a7e30ffe8ea9d796c4243a226b63088ad0e20e
MD5 d1bc0058b264330ae45841a772d4f503
SHA1 1e89326727d7bd32061877de14fe9580ad327b2e
SHA512 e791bad92cdad75b0a511108ca3480ba35dcdb1a3e1b7acf3ea82be8850ea6429aaf39938d5d7ca56355d030f8b8a8090a049305e6fa355c8e790d489560acc6
SSDEEP 24:DINlA0NV0A0NF0Q0N10g0Nl0w0NV0A0NF0Q0N10g0Nl0w0X0AXEXNy0X0Ni0f0Nd:3
TLSH
T115B22383EB619A7C86ED1523C4C03052B78E752AE637383BCDEB039180CFB0B2129D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

min-11-light.png

Path C:\Users\Admin\AppData\Local\Temp\is-UQRG5.tmp\min-11-light.png
Size 5KB
SHA256 fef9a507556a330f457eac557c0f430c8993de5b61638c455a3f4311b0bd47a3
MD5 ae83cb00d3895eb95c9c4d0d88403147
SHA1 936954c807f179a4db43fda0e494af14c0ee8698
SHA512 528bde4f156ddb7699e94ef4cbf4c9e00c2a844e4b985b73bf4e813f81f1a202122caa30ba4f2204a96c38ffcc49dbeade72ec938c16405e2961a7dbf526368a
SSDEEP 96:Ie/Pih/pbFjj28Ed1k0IBxQF/at2Zb+Jm:D/PijljqLkHGS0
TLSH
T149B1EA468A1071ECD18D9A3111F9C716163FC06769829E95B4BF04372F223ED2D5F5D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1396-206-0x0000000003F70000-0x00000000040B0000-memory.dmp

Download

memory/1396-140-0x00000000048B0000-0x00000000049F0000-memory.dmp

Download

memory/1396-671-0x00000000007F0000-0x0000000000BE7000-memory.dmp

Download

memory/1396-943-0x00000000007F0000-0x0000000000BE7000-memory.dmp

Download

memory/1396-1353-0x00000000007F0000-0x0000000000BE7000-memory.dmp

Download

memory/1396-207-0x0000000003F70000-0x00000000040B0000-memory.dmp

Download

memory/1396-1210-0x00000000007F0000-0x0000000000BE7000-memory.dmp

Download

memory/1396-122-0x00000000007F0000-0x0000000000BE7000-memory.dmp

Download

memory/1396-139-0x0000000003F70000-0x00000000040B0000-memory.dmp

Download

memory/1396-137-0x000000006F5A0000-0x000000006F5B4000-memory.dmp

Download

memory/1396-1033-0x00000000007F0000-0x0000000000BE7000-memory.dmp

Download

memory/1396-136-0x00000000090C0000-0x00000000090D4000-memory.dmp

Download

memory/1460-103-0x0000000000CE0000-0x0000000000E18000-memory.dmp

Download

memory/1460-121-0x0000000000CE0000-0x0000000000E18000-memory.dmp

Download

memory/3456-1292-0x00007FFFA6980000-0x00007FFFA6981000-memory.dmp

Download

memory/4136-32-0x0000000004D50000-0x0000000004E90000-memory.dmp

Download

memory/4136-34-0x00000000097B0000-0x0000000009842000-memory.dmp

Download

memory/4136-6-0x00000000035C0000-0x00000000035C1000-memory.dmp

Download

memory/4136-93-0x00000000739F2000-0x00000000739F3000-memory.dmp

Download

memory/4136-91-0x0000000000160000-0x0000000000557000-memory.dmp

Download

memory/4136-92-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/4136-17-0x00000000035C0000-0x00000000035C1000-memory.dmp

Download

memory/4136-75-0x00000000739E0000-0x000000007419C000-memory.dmp

Download

memory/4136-72-0x0000000004D50000-0x0000000004E90000-memory.dmp

Download

memory/4136-71-0x0000000000160000-0x0000000000557000-memory.dmp

Download

memory/4136-67-0x0000000000160000-0x0000000000557000-memory.dmp

Download

memory/4136-65-0x0000000004D50000-0x0000000004E90000-memory.dmp

Download

memory/4136-63-0x0000000004D50000-0x0000000004E90000-memory.dmp

Download

memory/4136-64-0x00000000739E0000-0x000000007419C000-memory.dmp

Download

memory/4136-62-0x0000000004D50000-0x0000000004E90000-memory.dmp

Download

memory/4136-228-0x00000000739E0000-0x000000007419C000-memory.dmp

Download

memory/4136-16-0x0000000000160000-0x0000000000557000-memory.dmp

Download

memory/4136-30-0x00000000750E0000-0x00000000750F4000-memory.dmp

Download

memory/4136-29-0x0000000007520000-0x0000000007534000-memory.dmp

Download

memory/4136-25-0x00000000739F2000-0x00000000739F3000-memory.dmp

Download

memory/4136-24-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Download

memory/5168-229-0x0000000000CD0000-0x0000000000E08000-memory.dmp

Download

memory/5168-15-0x0000000000CD0000-0x0000000000E08000-memory.dmp

Download

memory/5168-0-0x0000000000CD0000-0x0000000000E08000-memory.dmp

Download

memory/5208-76-0x0000000000CD0000-0x0000000000E08000-memory.dmp

Download

memory/5208-94-0x0000000000CD0000-0x0000000000E08000-memory.dmp

Download

memory/5288-119-0x00000000006D0000-0x0000000000AC7000-memory.dmp

Download

memory/5288-96-0x00000000006D0000-0x0000000000AC7000-memory.dmp

Download

memory/5808-1301-0x00007FFFA6980000-0x00007FFFA6981000-memory.dmp

Download