303c59cae53076324e7eee576eb97afdcc8dec98af85ff9516d41a7934a858ba

Analysis

user interaction
yes
max time kernel
95s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/08/2026, 13:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shiftx emu.exe
Size 13.3MB
Sample260826-qysdrsem2s
SHA256 303c59cae53076324e7eee576eb97afdcc8dec98af85ff9516d41a7934a858ba
MD5 6b38bbfb573f6818c2021dc7f18bb956
SHA1 14f6cd3e66af550a73dae349084b4bc0c8a005ff
SHA512 db4c866767748da6556006ff3702269103a7889bb4fe9ffd3153bf0def7b3569758e89d8db567905f947fbc508c39ddffb552f696c0c2d8c7154b92d151c8018
SSDEEP 393216:NWGEjCK+7jJa3QCgTp38kqHM1CPwDvt3uFdCaVEFzwjibvV:NWGcCy1XH9Vm
TLSH
T171E6CF6AA7BC0149E4A7D1BCC2935323D772B91923B057CF5A604AF81F27BD51A7E380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2992	shiftx emu.exe
2992	shiftx emu.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3332	cmd.exe
5016	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322252875521533"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5016	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2992	shiftx emu.exe
2992	shiftx emu.exe
2992	shiftx emu.exe
2992	shiftx emu.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe
Token: SeShutdownPrivilege	5240	chrome.exe
Token: SeCreatePagefilePrivilege	5240	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe
5240	chrome.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 3332	2992	shiftx emu.exe	80
PID 3332 wrote to memory of 5016	3332	cmd.exe	82
PID 3332 wrote to memory of 5880	3332	cmd.exe	83
PID 5240 wrote to memory of 1228	5240	chrome.exe	95
PID 5240 wrote to memory of 1076	5240	chrome.exe	97
PID 5240 wrote to memory of 2224	5240	chrome.exe	96
PID 5240 wrote to memory of 1076	5240	chrome.exe	97
PID 5240 wrote to memory of 1120	5240	chrome.exe	98
PID 5240 wrote to memory of 1120	5240	chrome.exe	98
PID 5240 wrote to memory of 5392	5240	chrome.exe	100
PID 5240 wrote to memory of 5392	5240	chrome.exe	100
PID 5240 wrote to memory of 2084	5240	chrome.exe	99
PID 5240 wrote to memory of 2084	5240	chrome.exe	99
PID 5240 wrote to memory of 4972	5240	chrome.exe	101
PID 5240 wrote to memory of 4972	5240	chrome.exe	101
PID 5240 wrote to memory of 1816	5240	chrome.exe	104
PID 5240 wrote to memory of 1816	5240	chrome.exe	104
PID 5240 wrote to memory of 5916	5240	chrome.exe	105
PID 5240 wrote to memory of 4860	5240	chrome.exe	107
PID 5240 wrote to memory of 4860	5240	chrome.exe	107
PID 5240 wrote to memory of 4544	5240	chrome.exe	108
PID 5240 wrote to memory of 4544	5240	chrome.exe	108
PID 5240 wrote to memory of 5992	5240	chrome.exe	109
PID 5240 wrote to memory of 4092	5240	chrome.exe	110
PID 5240 wrote to memory of 4844	5240	chrome.exe	111
PID 5240 wrote to memory of 3440	5240	chrome.exe	112
PID 5240 wrote to memory of 3440	5240	chrome.exe	112
PID 5240 wrote to memory of 2152	5240	chrome.exe	113
PID 5240 wrote to memory of 2152	5240	chrome.exe	113
PID 5240 wrote to memory of 4468	5240	chrome.exe	114
PID 5240 wrote to memory of 4468	5240	chrome.exe	114
PID 5240 wrote to memory of 4280	5240	chrome.exe	115
PID 5240 wrote to memory of 4280	5240	chrome.exe	115
PID 5240 wrote to memory of 5784	5240	chrome.exe	116
PID 5240 wrote to memory of 5784	5240	chrome.exe	116

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5880	attrib.exe

C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe
"C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul & attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe" & del /f /q "C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5016
- - C:\Windows\system32\attrib.exe
    attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\shiftx emu.exe"
    3⤵
    - Views/modifies file attributes
    PID:5880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5108

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:2196

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:3228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:4752

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd57aec728,0x7ffd57aec734,0x7ffd57aec740
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,7333985704786406020,5852322349478333202,524288 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,9474757070246863685,5181579774403437424,262144 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,9078144319010202122,9758478276209377400,524288 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2396 /prefetch:13
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,12746072791706227836,13843843941958362119,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,1345633451710413925,8041426956742133617,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,17791295550493160010,13266724657860199395,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4316 /prefetch:9
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,4739438963918503771,13187596009810435253,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,3844651281990279973,14027499992523028475,524288 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5560,i,16681705214576688634,8506161239432160415,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5996,i,8318024733395847367,7294180428503417654,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3684,i,6422131279552272059,12647463372279185279,524288 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=220 /prefetch:14
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3668,i,13773227802024234025,6328679322518832876,524288 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,18390080039537642393,14221056364619441246,524288 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3512,i,17770723990827065161,13327692189870895746,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5928,i,6648954178591394874,16062636315511951090,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4420,i,1730458135358777796,12948543252288146991,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6048,i,16310915660392346534,12451384034156214256,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6036,i,13084269379057051082,16055256657057100627,2097152 --field-trial-handle=2092,i,3552435910937848926,10682462065803474008,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 faa8eb7649281e6cd14def4ee3efefd41ece9f8e30282268a4d72ee530aa0b76
MD5 f53275e01c5f4794efa82a184b06b57a
SHA1 2ef164fe5f73ed428d8ed240fe0a85a7f784aae1
SHA512 6be5c0285d001229e2ed470f785e9c4543653e8f4ebad64f2e40dd22d150c5902f585d88042839de33cb2e6de2e3088c124626658f0d33944057274b3eb7efa8
TLSH
T129E02BA9C821BC270CFD1B6CA1550346D66003172B909E5F3B3C810C8FB1A3A814681C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a36e8658199628e6c081393722e269966ab708fb11e14c3f69a28d2af5fb88f0
MD5 92914afae600d84ee7687fb28867bda5
SHA1 a6edb2f1a5d5fc670f462de092f051b5c8c0cf14
SHA512 6cb55a878345022fcd8a398b5d1539f26513c1a0fe296d61ac0853a0b6eaa1e18d86b0b8fcc2d1bbc84085d405563921467e96d91c4d891822399e49b27011a3
SSDEEP 192:rR0dvvs0M/nnv7HhAPRp2y9DHQnb+WNgKW2p1QHnXekaraGh6kwLmUPI+VyIsnAq:rR09kdPvj8XR5OvSnX3araGh6rXI2e
TLSH
T1CA52E62EB910693B5CDBD229FE657B67EBF1102121D02EC8E6FC892C15E75DC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 28eb155abec928514c6c8aec2e157b450fb60357814534abf87664dbf0dfe5b3
MD5 073a7ffc5b6220da6a2d1bd95b6f3ec0
SHA1 cf9c865051ddd2c2cd196c8f26590d54c843cb3d
SHA512 7b99df2e4b74c4d7738f98a4c23c05c965b4ef8c8d59a8b7b8de047661c50b1ef5b78a44d39023c5b74994d9207db737d287fb62356d48d56d45bcfaed1ba18a
SSDEEP 192:yR0dvvs0M/hZv7HhAPRp2y9DHQ3b+WNgKW2p1pW0sekaraGh6kwLmUPI+VyIsnAq:yR09kd55j8XR5uvK0s3araGh6rXI2e
TLSH
T17752D62EA910693B5CDBD219FE657B67EBF5102221D01EC8EAFC892C15E75DC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 9d0427e4ef3b8218e82f22fc85852d9c24a5e07d95c2c282aff5a48dda64290b
MD5 6036cbee6c38236dd6da75ccbacced4b
SHA1 b5a5851df8f3c1d2aeda09af95c1e4d982d091cc
SHA512 cc842d064a1284b51d8cfa9382a3e85b9f0b9ac9c281f5e373fb204f5bdc7a63bfeaef3d461e54d471483f74ea6e743ae506bf1c6f64314506bf04be37c91aa6
SSDEEP 192:YR0dvvs0M/0nv7HpAPRp2y9DHsb+WNn2l0/DekaraGh6kwLmUvI+VyIsnAUgtaJ:YR09kdcvjUXR5wg0/D3araGh6rHI28
TLSH
T16A42D72EB910693B5CCAC219FD657B63EBF5103121D42EC8EAFC892C15E75DC222741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d3f97b117dc369a5956628a151166c3076350403fcfa84c9167f29eba6163185
MD5 101b85f4f88d93c088ed4d53eb519b69
SHA1 751100736fc3a71236ed7874b74142afab7ef1fb
SHA512 bce646885517867ff17b89df80cc4e732681d43f8d1cee24830a3733aec86c7c88487d545b33d587f17e73e55ccdd78e12c0c07b599411921fec2348daaf3f34
TLSH
T1C7B0120080419142C0C202B01542258C71145F10E60A170193F86D32C8695F180160A2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590229.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590229.TMP
Size 96B
SHA256 a93ddd274eb8a18dd89e8a53774d521f0c5e5472f072e2be596338257e31269e
MD5 5c1b406e20448264663e1076dbeebdcb
SHA1 f58fa578d2468acc1f9664ee5bcb52abbe8c046f
SHA512 56ebb814fbead616c3d53f320b5bdd61bc4b271b22d9107a998ef09058382c03aa1ec62ba3cb5a3bd6d124eb8cd07893b02f6e7b1bc64e5de3211d9b0d67103c
TLSH
T190B02228C002A222C88203B822C2A0C83020CF20C203230282F00A22CCA22300820030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 a50e4951053d83fa722eafc3371969153da15a66ce8d651621b479b68ab9aa85
MD5 c7d6e96bb9d91ce62bdd6ed4af57dcbb
SHA1 ab288ca84dbb321f3b5bb4c4a4562c263fd82096
SHA512 9431d7ce06cd8a6ff02d18e7420729213fe5321e0935df74bc45013aa52107d135c9ee7030c283c40ba63fd3763d98424459cb79400ba2f362493038efb89860
SSDEEP 6144:h7hOurjMI+G9bjWcTHv3Af/m7Rkm1tYpBeh2BAoQ:R0u8i9bjvHvyO9oBGcAoQ
TLSH
T18434131B6DB5BCB25624BB8EF44F092F1EF459BACE20FA5184D6560846FD2DD1E00B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 6d6ab560b85eedd73970af1047b1264883bf6d1c28a4941a90cc21cc21ccdbec
MD5 a9bc11488c9d557c85b8346173556cb3
SHA1 505d4d9db5646422fd99a1c500dc971bd8751744
SHA512 6085548eba94af9b180ad9ddf9b7beb5a4b4390299c4c29566394cf2d2ce072543764c12857fd902c75245966f779c836bbdc8928dd5f70af0f53c494054c4bf
SSDEEP 6144:TQ7hOurjMI+G9bjWcTHv3Af/m7Rkm1tYpBeh2BAoQ:A0u8i9bjvHvyO9oBGcAoQ
TLSH
T16634123B6DB5BCB21634BB8EF44F192F0DF459ABCE20FA1584D51A0446F82DE1E00A78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 9793a9ba88546ebd4be89d4b167245267ffbf712ea47b97f8b9eb443640ea444
MD5 bae9dcf222175e449a6df6503ffead7a
SHA1 9054df2492d182657b02a3dd4c4565c01d32fe36
SHA512 0f1676e4fe5460b4b8b5e2bb8fa4a26df80a19037ddf10a9562e1949351c594be5883cafedb51099074070129fac75a7f1c71a03a6d329a8200ab30c4326c962
SSDEEP 6144:v7hOurjMI+G9bjWcTHv3Af/m7Rkm1tYpBeh2BAoQ:z0u8i9bjvHvyO9oBGcAoQ
TLSH
T10934131B6DB5BCB25624FB8EF44F092F1EF459BACE20FA5184D6560846F92DD1E00B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a25131848331bed37fdf9b20f650eaeeed0c42e11ff5312ab5668b858f80b7f3
MD5 8f61d77bbbdea8302d907b7d290bd16c
SHA1 01d03bba58a3def4680bfffce4fcb31734ce4c1f
SHA512 947e941723094e1473ee4d659e78b1051dc45bbc5be5a6be615a90df8b158dc117e85cca25d30b05b286c13bb1e767f7f6d5fcca695daaf0f7848de91ce8107e
SSDEEP 3072:nGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Gm7Rkm1tYpBeh2BAo+
TLSH
T18BC3122B5D71A93758B9A74EB08E0B1F1EF149A6C930DE82C8D85B0477F66CC1A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-4-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\shiftx-openssl-1.1.9\libcrypto-4-x64.dll
Size 6.8MB
SHA256 2293979c545c2e798e141e2c13f1107687a15c590fa428976ea11a38f462c720
MD5 78d8a5fd222b13150419e49877623a3b
SHA1 3adb4f03f732e568fb767fcfe2bef0f549109572
SHA512 a088d8e2a3f74aa8120c3ebbcc62f2468a839f082e44c26c409eb450b7e54bdbad3fc90d65bbb75a632efa110e567019b9c547340f7df2c796eafb8e9f70a4f9
SSDEEP 196608:9K+7jJa3qhCgTp38kfCHM1CPwDvt3uFv1Ca:9K+7jJa3QCgTp38kqHM1CPwDvt3uFdCa
TLSH
T144767C6DA6BC0105E4ABC0BDC2975327DB71B91967B013CF596186F80F27BD92A7E380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-4-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\shiftx-openssl-1.1.9\libssl-4-x64.dll
Size 1.3MB
SHA256 dc1badd14417f670cd841979732b51553a47c26f35132126efc146be70cd5a03
MD5 ff32d1563d516a7171a7ff4f1ab29b6f
SHA1 facb3a1db98b3c3e891cc7837793954e2243138e
SHA512 4fd9a5fb169173b3473ffa11833b227ae3db4fd0b02b9faa83643f3974f2b379416fcb967bec2682c5449c69c90337ae2f0da39eb910e71ac4c51ed25194bc57
SSDEEP 24576:l8OkGKABk/kg/V7OYp0jfEsoNc2aGXh+jibvVN:3kGTakg/V7OYODE7aGwjibvV
TLSH
T1A4555D6AA7B8015CE8B6C17D86834723D6B6F4153330ABDF065989391F63BE6273D384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5484-74-0x000001BF74660000-0x000001BF74748000-memory.dmp

Download