Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 12:30
General
- Target Shift%20-%20PDF_x55p21.exe
- Size 8.5MB
- Sample260727-ppnhsascmc
- SHA256 728d156bd4da92dd8c3a22317154a074960e0dc1f4a1db83e5af56ef4ddf55c2
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Script User-Agent 5 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shift%20-%20PDF_x55p21.exe"C:\Users\Admin\AppData\Local\Temp\Shift%20-%20PDF_x55p21.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A2PTI.tmp\Shift%20-%20PDF_x55p21.tmp"C:\Users\Admin\AppData\Local\Temp\is-A2PTI.tmp\Shift%20-%20PDF_x55p21.tmp" /SL5="$50230,7452306,1214464,C:\Users\Admin\AppData\Local\Temp\Shift%20-%20PDF_x55p21.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shift%20-%20PDF_x55p21.exe"C:\Users\Admin\AppData\Local\Temp\Shift%20-%20PDF_x55p21.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxMTEzNjk0MSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyNyIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDYtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDY5Mzg4MSIsImdjbGlkIjoiRUFJYUlRb2JDaE1JbTlmdzdhdnlsUU1WSGM4TkNSMnZmQ1VwRUFFWUFTQUFFZ0xtWGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWZyIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjEwNjJjNTgxLTQwYzUtNDhhNy04ZWMyLTg5NTM4OTc5ZmFkNiIsImxhbmciOiJmciIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg1MTU1NTM1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0Ny4wLjAuMzAyIiwiYXR0cmlidXRpb25fa2V5IjoieDU1cDIxIiwic3BsaXQiOiJiIiwic3BsaXQyIjoiYiIsIm5vX3NwbGl0IjpmYWxzZX0= /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7Im5ld19idWlsZF9sYXVuY2hfbW9uaXRvcl9leHBlcmltZW50Ijp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDEzMjc2X29wZW5lcl90YWJfYmFja19wbWZfNTBfNTAiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTA2M19icmluZ190b19mb3JlZ3JvdW5kX21heGltaXplZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUxMTFfcGlsaWhfbGltaXRlcl9vbl91bmxvY2siOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NjEyNV9hbHRlcm5hdGVfZG93bmxvYWRfY2RuIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0MTM5MV9kb250X2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0OTMxOV8zd2F5X29tbmlib3hfZm9jdXMiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q0NTczX2ltcHJvdmVfYnJpbmdfdG9fZm9yZWdyb3VuZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ9 /LAUNCHER /VERYSILENT3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PMQ52.tmp\Shift%20-%20PDF_x55p21.tmp"C:\Users\Admin\AppData\Local\Temp\is-PMQ52.tmp\Shift%20-%20PDF_x55p21.tmp" /SL5="$70266,7452306,1214464,C:\Users\Admin\AppData\Local\Temp\Shift%20-%20PDF_x55p21.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxMTEzNjk0MSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyNyIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDYtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDY5Mzg4MSIsImdjbGlkIjoiRUFJYUlRb2JDaE1JbTlmdzdhdnlsUU1WSGM4TkNSMnZmQ1VwRUFFWUFTQUFFZ0xtWGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWZyIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjEwNjJjNTgxLTQwYzUtNDhhNy04ZWMyLTg5NTM4OTc5ZmFkNiIsImxhbmciOiJmciIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg1MTU1NTM1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0Ny4wLjAuMzAyIiwiYXR0cmlidXRpb25fa2V5IjoieDU1cDIxIiwic3BsaXQiOiJiIiwic3BsaXQyIjoiYiIsIm5vX3NwbGl0IjpmYWxzZX0= /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7Im5ld19idWlsZF9sYXVuY2hfbW9uaXRvcl9leHBlcmltZW50Ijp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDEzMjc2X29wZW5lcl90YWJfYmFja19wbWZfNTBfNTAiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTA2M19icmluZ190b19mb3JlZ3JvdW5kX21heGltaXplZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUxMTFfcGlsaWhfbGltaXRlcl9vbl91bmxvY2siOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NjEyNV9hbHRlcm5hdGVfZG93bmxvYWRfY2RuIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0MTM5MV9kb250X2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0OTMxOV8zd2F5X29tbmlib3hfZm9jdXMiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q0NTczX2ltcHJvdmVfYnJpbmdfdG9fZm9yZWdyb3VuZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ9 /LAUNCHER /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shift Setup_x55p21.exe"C:\Users\Admin\AppData\Local\Temp\Shift Setup_x55p21.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxMTEzNjk0MSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyNyIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDYtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDY5Mzg4MSIsImdjbGlkIjoiRUFJYUlRb2JDaE1JbTlmdzdhdnlsUU1WSGM4TkNSMnZmQ1VwRUFFWUFTQUFFZ0xtWGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWZyIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjEwNjJjNTgxLTQwYzUtNDhhNy04ZWMyLTg5NTM4OTc5ZmFkNiIsImxhbmciOiJmciIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg1MTU1NTM1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0Ny4wLjAuMzAyIiwiYXR0cmlidXRpb25fa2V5IjoieDU1cDIxIiwic3BsaXQiOiJiIiwic3BsaXQyIjoiYiIsIm5vX3NwbGl0IjpmYWxzZX0= /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7Im5ld19idWlsZF9sYXVuY2hfbW9uaXRvcl9leHBlcmltZW50Ijp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDEzMjc2X29wZW5lcl90YWJfYmFja19wbWZfNTBfNTAiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTA2M19icmluZ190b19mb3JlZ3JvdW5kX21heGltaXplZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUxMTFfcGlsaWhfbGltaXRlcl9vbl91bmxvY2siOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NjEyNV9hbHRlcm5hdGVfZG93bmxvYWRfY2RuIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0MTM5MV9kb250X2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0OTMxOV8zd2F5X29tbmlib3hfZm9jdXMiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q0NTczX2ltcHJvdmVfYnJpbmdfdG9fZm9yZWdyb3VuZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ95⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-B9906.tmp\Shift Setup_x55p21.tmp"C:\Users\Admin\AppData\Local\Temp\is-B9906.tmp\Shift Setup_x55p21.tmp" /SL5="$9005C,178323694,1214464,C:\Users\Admin\AppData\Local\Temp\Shift Setup_x55p21.exe" /PDATA=eyJnYWRfc291cmNlIjoiNSIsImFkX2Jsb2NrZXJfZGV0ZWN0ZWQiOmZhbHNlLCJ1dG1fY2FtcGFpZ24iOiIyMjUxMTEzNjk0MSIsInByb2ZpbGUiOiJzaGlmdC1wZGYiLCJ1dG1fbWVkaXVtIjoiIiwidmlzaXRvcl9pZCI6IjEwODI2MDcyNyIsInVhIjoiZWRnZSIsImluc3RhbGxlcl9maWxlbmFtZSI6InNoaWZ0LXYxNDQuMy44MDYtd2ViLmV4ZSIsInV0bV90ZXJtIjoiIiwiZ2FkX2NhbXBhaWduaWQiOiIyMjUxNDY5Mzg4MSIsImdjbGlkIjoiRUFJYUlRb2JDaE1JbTlmdzdhdnlsUU1WSGM4TkNSMnZmQ1VwRUFFWUFTQUFFZ0xtWGZEX0J3RSIsInRoYW5rc191cmwiOiJodHRwczovL2FwcC5zaGlmdC5jb20vcGRmL3RoYW5rcz9sYW5nPWZyIiwibHBfdXJsIjoiaHR0cHM6Ly9hcHAuc2hpZnQuY29tL3BkZi8xIiwicHJvZmlsZV9pZCI6MTA4LCJkaXN0aW5jdF9pZCI6IjEwNjJjNTgxLTQwYzUtNDhhNy04ZWMyLTg5NTM4OTc5ZmFkNiIsImxhbmciOiJmciIsIndoaXRlbGFiZWwiOiJwZGYiLCJ1dG1fY29udGVudCI6IiIsInV0bV9zb3VyY2UiOiJvaC1wbWF4IiwiaW5zdGFsbF90aW1lIjoxNzg1MTU1NTM1LCJkZWZhdWx0X2Jyb3dzZXIiOiJNaWNyb3NvZnQgRWRnZSIsImluaXRpYWxfdmVyc2lvbiI6IjE0Ny4wLjAuMzAyIiwiYXR0cmlidXRpb25fa2V5IjoieDU1cDIxIiwic3BsaXQiOiJiIiwic3BsaXQyIjoiYiIsIm5vX3NwbGl0IjpmYWxzZX0= /SPLITS=eyJzcGxpdCI6ImIiLCJzcGxpdDIiOiJiIiwibm9fc3BsaXQiOmZhbHNlLCJsb2NhbF9zcGxpdF90ZXN0cyI6e30sInNlcnZlcl9zaWRlX3NwbGl0X3Rlc3RzIjp7Im5ld19idWlsZF9sYXVuY2hfbW9uaXRvcl9leHBlcmltZW50Ijp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzJfcmVuYW1lX3Nob3J0Y3V0c19zaGlmdF9icm93c2VyIjp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0NDMzN19zdDQzMzhfb3Blbl92aXNpdGVkX3NpdGVzX2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0MTI5NDFfb21uaWJveF9wbGFjZWhvbGRlcl90ZXh0Ijp7InZhbHVlIjoidmFyaWF0aW9uMiJ9LCJzcGxpdF9zdDEzMjc2X29wZW5lcl90YWJfYmFja19wbWZfNTBfNTAiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTA2M19icmluZ190b19mb3JlZ3JvdW5kX21heGltaXplZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbiJ9LCJzcGxpdF9zdDUxMTFfcGlsaWhfbGltaXRlcl9vbl91bmxvY2siOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NjEyNV9hbHRlcm5hdGVfZG93bmxvYWRfY2RuIjp7InZhbHVlIjoiY29udHJvbCJ9LCJzcGxpdF9zdDEyMzZfcGluX3Byb2ZpbGVfYXBwX3RvX3Rhc2tiYXIiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0MTM5MV9kb250X2ltcG9ydF9oaXN0b3J5Ijp7InZhbHVlIjoidmFyaWF0aW9uIn0sInNwbGl0X3N0OTMxOV8zd2F5X29tbmlib3hfZm9jdXMiOnsidmFsdWUiOiJjb250cm9sIn0sInNwbGl0X3N0NTY1NF9yZWd1bGFyX3ZzX3NpbXBsaWZpZWRfYXBwX3ZpZXciOnsidmFsdWUiOiJ2YXJpYXRpb24ifSwic3BsaXRfc3Q1NTgyX3BpbGloX3ByaW1hcnlfbW9uaXRvciI6eyJ2YWx1ZSI6ImNvbnRyb2wifSwic3BsaXRfc3Q0NTczX2ltcHJvdmVfYnJpbmdfdG9fZm9yZWdyb3VuZCI6eyJ2YWx1ZSI6InZhcmlhdGlvbjIifSwic3BsaXRfc3Q2NDg4X2FtYXpvbl9tb25ldGl6ZWRfcHJlcGlubmVkIjp7InZhbHVlIjoiY29udHJvbCJ9fSwiYXR0cmlidXRpb25fc3BsaXRfdGVzdHMiOnt9LCJlbmNvZGVkX3NwbGl0cyI6IjAwMCJ96⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Shift%20-%20PDF_x55p21.tmp
Win32Library.dll
shift-pdf.png
shift.png
memory/1188-120-0x0000000000360000-0x0000000000757000-memory.dmp
memory/3444-15-0x0000000000D20000-0x0000000000E58000-memory.dmp
memory/3444-1-0x0000000000D20000-0x0000000000E58000-memory.dmp
memory/4580-70-0x0000000003AD0000-0x0000000003C10000-memory.dmp
memory/4580-75-0x0000000000430000-0x0000000000827000-memory.dmp
memory/4580-33-0x0000000073942000-0x0000000073943000-memory.dmp
memory/4580-37-0x0000000008FC0000-0x0000000008FD4000-memory.dmp
memory/4580-38-0x00000000750B0000-0x00000000750C4000-memory.dmp
memory/4580-40-0x0000000003AD0000-0x0000000003C10000-memory.dmp
memory/4580-42-0x0000000009090000-0x0000000009122000-memory.dmp
memory/4580-21-0x0000000000430000-0x0000000000827000-memory.dmp
memory/4580-16-0x0000000000430000-0x0000000000827000-memory.dmp
memory/4580-17-0x00000000038B0000-0x00000000038B1000-memory.dmp
memory/4580-71-0x0000000073930000-0x00000000740EC000-memory.dmp
memory/4580-72-0x0000000003AD0000-0x0000000003C10000-memory.dmp
memory/4580-73-0x0000000003AD0000-0x0000000003C10000-memory.dmp
memory/4580-32-0x0000000003AC0000-0x0000000003AD0000-memory.dmp
memory/4580-80-0x0000000003AD0000-0x0000000003C10000-memory.dmp
memory/4580-83-0x0000000003AC0000-0x0000000003AD0000-memory.dmp
memory/4580-84-0x0000000073930000-0x00000000740EC000-memory.dmp
memory/4580-6-0x00000000038B0000-0x00000000038B1000-memory.dmp
memory/4580-91-0x0000000073942000-0x0000000073943000-memory.dmp
memory/4580-90-0x0000000000430000-0x0000000000827000-memory.dmp
memory/4736-118-0x0000000000D20000-0x0000000000E58000-memory.dmp
memory/4736-87-0x0000000000D20000-0x0000000000E58000-memory.dmp
memory/5044-103-0x0000000000670000-0x00000000007A8000-memory.dmp
memory/5044-121-0x0000000000670000-0x00000000007A8000-memory.dmp
memory/6132-122-0x0000000000EB0000-0x00000000012A7000-memory.dmp