Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Shift Setup.exe

Overview

General Information

Sample name:Shift Setup.exe
Analysis ID:1541415
MD5:0f0da32e4bde27b239dc562c4cc2ad1e
SHA1:872f2163447e8f73feb3d07cc09ead672b9f76b5
SHA256:416924d36d3b81e047ded649f18bf11999968278b46931824be5ecc9170a30ba
Infos:

Detection

Score:26
Range:0 - 100
Whitelisted:false
Confidence:0%

Compliance

Score:35
Range:0 - 100

Signatures

Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
EXE planting / hijacking vulnerabilities found
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries keyboard layouts
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches the installation path of Mozilla Firefox
Sigma detected: CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Stores large binary data to the registry
Tries to disable installed Antivirus / HIPS / PFW
Uses 32bit PE files
Uses taskkill to terminate processes
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64native
  • Shift Setup.exe (PID: 8524 cmdline: "C:\Users\user\Desktop\Shift Setup.exe" MD5: 0F0DA32E4BDE27B239DC562C4CC2AD1E)
    • Shift Setup.tmp (PID: 8548 cmdline: "C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp" /SL5="$10468,95019598,1164800,C:\Users\user\Desktop\Shift Setup.exe" MD5: DD387924C262802D2BDFB7C7201E3DF5)
      • taskkill.exe (PID: 8816 cmdline: "C:\Windows\System32\taskkill.exe" /f /im shift.exe MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
        • conhost.exe (PID: 8824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • schtasks.exe (PID: 9104 cmdline: "schtasks" /delete /tn ShiftLaunchTask /f MD5: 796B784E98008854C27F4B18D287BA30)
        • conhost.exe (PID: 9112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • shift.exe (PID: 9184 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --start-maximized MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 9204 cmdline: C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718 MD5: 57FF3A035DA210EAF2B467E8DB148635)
          • shift.exe (PID: 7164 cmdline: C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 3108 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 1536 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 4088 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 1256 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 8516 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 8848 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • explorer.exe (PID: 4968 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)
          • shift.exe (PID: 1112 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in MD5: 57FF3A035DA210EAF2B467E8DB148635)
          • shift.exe (PID: 1592 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 3436 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 3332 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 8100 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 3440 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • shift.exe (PID: 4760 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8 MD5: 57FF3A035DA210EAF2B467E8DB148635)
        • setup.exe (PID: 3888 cmdline: setup.exe --do-not-launch-chrome MD5: 1D06621473A8216A98687546A595EC5D)
          • setup.exe (PID: 2032 cmdline: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428 MD5: 1D06621473A8216A98687546A595EC5D)
          • setup.exe (PID: 9144 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0 MD5: 1D06621473A8216A98687546A595EC5D)
            • setup.exe (PID: 6828 cmdline: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428 MD5: 1D06621473A8216A98687546A595EC5D)
        • shift.exe (PID: 9024 cmdline: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8 MD5: 57FF3A035DA210EAF2B467E8DB148635)
      • WerFault.exe (PID: 6484 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2700 MD5: 40A149513D721F096DDF50C04DA2F01F)
      • WerFault.exe (PID: 8140 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2444 MD5: 40A149513D721F096DDF50C04DA2F01F)
  • shift.exe (PID: 7984 cmdline: C:\Users\user\AppData\Local\Shift\chromium\shift.exe --start-maximized --launch-source=sign-in MD5: 57FF3A035DA210EAF2B467E8DB148635)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Shift\chromium\shift.exe, ProcessId: 9184, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ShiftAutoLaunch_53CF6764BCE293C804D7A1CE3A191AD0

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\new_shift.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\new_shift_proxy.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeEXE: setup.exeJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\127.2.2.1372\Installer\setup.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeJump to behavior

Compliance

barindex
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\new_shift.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\new_shift_proxy.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeEXE: setup.exeJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\127.2.2.1372\Installer\setup.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeEXE: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeJump to behavior
Uses 32bit PE files
Source: Shift Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Creates a directory in C:\Program Files
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeDirectory created: C:\Program Files\chrome_BITS_9184_1433764606Jump to behavior
Creates a software uninstall entry
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{95fcf903-63b1-44bd-ab77-358a5bd30aae}_is1Jump to behavior
Creates install or setup log file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Temp\chromium_installer.log
PE / OLE file has a valid certificate
Source: Shift Setup.exeStatic PE information: certificate valid
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: Shift Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\initialexe\shift.exe.pdb source: shift.exe, 00000007.00000000.5353689043.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\shift_elf.dll.pdb source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\shift_pwa_launcher.exe.pdb source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003ED5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\shift_wer.dll.pdb source: Shift Setup.tmp, 00000001.00000003.5381387856.000000000401E000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\Local\Shift\chromiumJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\Local\Shift\chromium\shift.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\Local\ShiftJump to behavior
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 108.138.106.101 108.138.106.101
Source: shift.exe, 00000007.00000003.5556722163.00004AB801E0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: Easily find and share everything that matters.","id":"charli","imageUrl":"https://apps.tryshiftcdn.com/charli/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/charli/image-monochrome.svg","name":"Charli","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://app.charli.ai/"]}},{"category":"Marketing and Analytics","colorImageUrl":"https://apps.tryshiftcdn.com/chartbeat/image-color.svg","description":"Chartbeat delivers real-time analytics, content intelligence, and transformative newsroom tools for digital media and publishing companies around the world.","id":"chartbeat","imageUrl":"https://apps.tryshiftcdn.com/chartbeat/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/chartbeat/image-monochrome.svg","name":"Chartbeat","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://chartbeat.com"]}},{"category":"Marketing and Analytics","colorImageUrl":"https://apps.tryshiftcdn.com/chartmogul/image-color.svg","description":"The leading subscription analytics platform. The best teams in SaaS use ChartMogul to measure, understand, and grow their recurring revenue.","id":"chartmogul","imageUrl":"https://apps.tryshiftcdn.com/chartmogul/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/chartmogul/image-monochrome.svg","name":"ChartMogul","urlOptions":{"urls":["https://app.chartmogul.com/"]}},{"category":"Accounting and Finance","colorImageUrl":"https://apps.tryshiftcdn.com/chase-bank/image-color.svg","description":"A national bank headquartered in Manhattan, New York City.","id":"chase-bank","imageUrl":"https://apps.tryshiftcdn.com/chase-bank/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/chase-bank/image-monochrome.svg","name":"Chase Bank","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://www.chase.com/"]}},{"category":"Social Media","colorImageUrl":"https://apps.tryshiftcdn.com/chatfuel/image-color.svg","description":"Chatfuel is the leading bot platform for creating AI chatbots for Facebook. Learn how to create a Facebook Messenger bot quickly and easily - no coding.","id":"chatfuel","imageUrl":"https://apps.tryshiftcdn.com/chatfuel/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/chatfuel/image-monochrome.svg","name":"Chatfuel","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://chatfuel.com/"]}},{"category":"Communication and Messaging","colorImageUrl":"https://apps.tryshiftcdn.com/chatgpt/image-color.svg","description":"ChatGPT is a large language model developed by OpenAI that can be used for natural language processing tasks such as text generation.","id":"chatgpt","imageUrl":"https://apps.tryshiftcdn.com/chatgpt/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/chatgpt/image-monochrome.svg","name":"ChatGPT","urlOptions":{"urls":["https://chat.openai.com"]}},{"category":"Communication and Messaging","colorImageUrl":"https://apps.tryshiftcdn.com/chatwork/image-color.svg","description":"ChatWork i
Source: shift.exe, 00000007.00000003.5568725271.00004AB801BC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/ equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5568725271.00004AB801BC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/J equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: ,$https://www.linkedin.com/sales/login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: /'https://www.linkedin.com/learning-login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5566790561.00004AB801360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: @www.youtube.com/ equals www.youtube.com (Youtube)
Source: shift.exe, 00000007.00000003.5566790561.00004AB801360000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: @www.youtube.com/J equals www.youtube.com (Youtube)
Source: shift.exe, 00000007.00000003.5564956392.00004AB802144000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `www.facebook.com equals www.facebook.com (Facebook)
Source: shift.exe, 00000007.00000003.5564956392.00004AB802144000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: `www.facebook.comJ equals www.facebook.com (Facebook)
Source: shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555913155.00004AB801318000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
Source: shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555913155.00004AB801318000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/ equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555913155.00004AB801318000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/learning-login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.linkedin.com/sales/login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566014283.00004AB801A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: m`www.linkedin.com/sales/login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566014283.00004AB801A44000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: m`www.linkedin.com/sales/loginJ equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801EF0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556722163.00004AB801E0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: s content operations platform unites revenue teams to speak in one voice across each customer journey.","id":"kapost","imageUrl":"https://apps.tryshiftcdn.com/kapost/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kapost/image-monochrome.svg","name":"Kapost","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://app.kapost.com/users/sign_in"]}},{"category":"Marketing and Analytics","colorImageUrl":"https://apps.tryshiftcdn.com/kaseya-bms/image-color.svg","description":"Kaseya BMS is a next-generation business management solution that was built specifically to help MSPs spend more time selling and delivering services.","id":"kaseya-bms","imageUrl":"https://apps.tryshiftcdn.com/kaseya-bms/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kaseya-bms/image-monochrome.svg","name":"Kaseya BMS","urlOptions":{"urls":["https://bms.kaseya.com/"]}},{"category":"Communication and Messaging","colorImageUrl":"https://apps.tryshiftcdn.com/kaseya-vsa/image-color.svg","description":"Automate software patch management and vulnerability management to ensure that all systems are up to date.","id":"kaseya-vsa","imageUrl":"https://apps.tryshiftcdn.com/kaseya-vsa/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kaseya-vsa/image-monochrome.svg","name":"Kaseya VSA","urlOptions":{"urls":["https://www.kaseya.com/products/vsa/"]}},{"category":"Miscellaneous","colorImageUrl":"https://apps.tryshiftcdn.com/kayak/image-color.svg","description":"Kayak searches hundreds of other travel sites at once to find the information you need to make the right decisions on flights, hotels & rental cars.","id":"kayak","imageUrl":"https://apps.tryshiftcdn.com/kayak/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kayak/image-monochrome.svg","name":"Kayak","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://www.kayak.com"]}},{"category":"Customer Support","colorImageUrl":"https://apps.tryshiftcdn.com/kayako/image-color.svg","description":"Kayako's help desk software allows companies of all sizes to provide excellent customer services across live chat, email, Facebook. and Twitter.","id":"kayako","imageUrl":"https://apps.tryshiftcdn.com/kayako/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kayako/image-monochrome.svg","name":"Kayako","urlOptions":{"allowCustomPath":false,"hasPrefix":true,"urls":[".kayako.com/"]}},{"category":"CRM and Sales","colorImageUrl":"https://apps.tryshiftcdn.com/keap/image-color.svg","description":"Keap equals www.facebook.com (Facebook)
Source: shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801EF0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556722163.00004AB801E0C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: s content operations platform unites revenue teams to speak in one voice across each customer journey.","id":"kapost","imageUrl":"https://apps.tryshiftcdn.com/kapost/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kapost/image-monochrome.svg","name":"Kapost","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://app.kapost.com/users/sign_in"]}},{"category":"Marketing and Analytics","colorImageUrl":"https://apps.tryshiftcdn.com/kaseya-bms/image-color.svg","description":"Kaseya BMS is a next-generation business management solution that was built specifically to help MSPs spend more time selling and delivering services.","id":"kaseya-bms","imageUrl":"https://apps.tryshiftcdn.com/kaseya-bms/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kaseya-bms/image-monochrome.svg","name":"Kaseya BMS","urlOptions":{"urls":["https://bms.kaseya.com/"]}},{"category":"Communication and Messaging","colorImageUrl":"https://apps.tryshiftcdn.com/kaseya-vsa/image-color.svg","description":"Automate software patch management and vulnerability management to ensure that all systems are up to date.","id":"kaseya-vsa","imageUrl":"https://apps.tryshiftcdn.com/kaseya-vsa/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kaseya-vsa/image-monochrome.svg","name":"Kaseya VSA","urlOptions":{"urls":["https://www.kaseya.com/products/vsa/"]}},{"category":"Miscellaneous","colorImageUrl":"https://apps.tryshiftcdn.com/kayak/image-color.svg","description":"Kayak searches hundreds of other travel sites at once to find the information you need to make the right decisions on flights, hotels & rental cars.","id":"kayak","imageUrl":"https://apps.tryshiftcdn.com/kayak/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kayak/image-monochrome.svg","name":"Kayak","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://www.kayak.com"]}},{"category":"Customer Support","colorImageUrl":"https://apps.tryshiftcdn.com/kayako/image-color.svg","description":"Kayako's help desk software allows companies of all sizes to provide excellent customer services across live chat, email, Facebook. and Twitter.","id":"kayako","imageUrl":"https://apps.tryshiftcdn.com/kayako/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/kayako/image-monochrome.svg","name":"Kayako","urlOptions":{"allowCustomPath":false,"hasPrefix":true,"urls":[".kayako.com/"]}},{"category":"CRM and Sales","colorImageUrl":"https://apps.tryshiftcdn.com/keap/image-color.svg","description":"Keap equals www.twitter.com (Twitter)
Source: shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801EF0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: t need to be a Linux expert to build a website powered by DigitalOcean, AWS, or Google Cloud.","id":"runcloud","imageUrl":"https://apps.tryshiftcdn.com/runcloud/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/runcloud/image-monochrome.svg","name":"RunCloud","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://manage.runcloud.io/"]}},{"category":"Accounting and Finance","colorImageUrl":"https://apps.tryshiftcdn.com/rydoo/image-color.svg","description":"Rydoo - corporate travel and expense management solution on-the-go in real time which will save you time and money.","id":"rydoo","imageUrl":"https://apps.tryshiftcdn.com/rydoo/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/rydoo/image-monochrome.svg","name":"Rydoo","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://accounts.rydoo.com/login"]}},{"category":"Communication and Messaging","colorImageUrl":"https://apps.tryshiftcdn.com/ryver/image-color.svg","description":"Get more done and save money by collaborating with your team all in one app. Team chat + task management + workflow automation.","id":"ryver","imageUrl":"https://apps.tryshiftcdn.com/ryver/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/ryver/image-monochrome.svg","name":"Ryver","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://signup.ryver.com/login"]}},{"category":"Legal and HR","colorImageUrl":"https://apps.tryshiftcdn.com/sagehr/image-color.svg","description":"An award-winning HR technology company that provides attendance, performance & recruitment management for customers worldwide.","id":"sagehr","imageUrl":"https://apps.tryshiftcdn.com/sagehr/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/sagehr/image-monochrome.svg","name":"SageHR","unreadExtractor":{"selectors":[".red-dot-notification"],"type":"boolean"},"urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://sage.hr/signin"]}},{"category":"CRM and Sales","colorImageUrl":"https://apps.tryshiftcdn.com/sales-navigator/image-color.svg","description":"LinkedIn Sales Navigator helps you find the right prospects faster with customized, sales-specific insights like lead recommendations, company updates, and more.","id":"sales-navigator","imageUrl":"https://apps.tryshiftcdn.com/sales-navigator/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/sales-navigator/image-monochrome.svg","name":"Sales Navigator","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://www.linkedin.com/sales/login"]}},{"category":"CRM and Sales","colorImageUrl":"https://apps.tryshiftcdn.com/salesflare/image-color.svg","description":"Try Salesflare, the #1 simple CRM for small businesses selling B2B. Integrate with Google & Outlook. Be fully mobile. Automate your CRM from existing data.","id":"salesflare","imageUrl":"https://apps.tryshiftcdn.com/salesflare/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/salesflare/image-monochrome.
Source: shift.exe, 00000007.00000003.5569596892.00004AB801B5C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566601860.00004AB80132C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566520718.00004AB801328000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: shift.exe, 00000007.00000003.5569596892.00004AB801B5C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566601860.00004AB80132C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566520718.00004AB801328000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.facebook.comJ equals www.facebook.com (Facebook)
Source: shift.exe, 00000007.00000003.5554616808.00004AB801364000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566601860.00004AB80132C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566520718.00004AB801328000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/ equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5554616808.00004AB801364000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566601860.00004AB80132C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566520718.00004AB801328000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/J equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5554616808.00004AB801364000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566601860.00004AB80132C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5568669308.00004AB801BDC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/learning-login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5554616808.00004AB801364000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5566601860.00004AB80132C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5568669308.00004AB801BDC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/learning-loginJ equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5563798269.00004AB802244000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553107905.00004AB801A34000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5568257919.00004AB801C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/sales/login equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5563798269.00004AB802244000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553107905.00004AB801A34000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5568257919.00004AB801C70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.linkedin.com/sales/loginJ equals www.linkedin.com (Linkedin)
Source: shift.exe, 00000007.00000003.5567583466.00004AB801D24000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552301527.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.youtube.com/ equals www.youtube.com (Youtube)
Source: shift.exe, 00000007.00000003.5567583466.00004AB801D24000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552301527.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: www.youtube.com/J equals www.youtube.com (Youtube)
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1423136
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/1452
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/2152
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3246
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/3682
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5007
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5658
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/5750
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/6041
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7036
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7279
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7724
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7760
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/7761
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8280
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8297
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://anglebug.com/8417
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cert.ssl.com/SSL.com-timeStamping-I-RSA-R1.cer0Q
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crbug.com/941620
Source: Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A1F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/SSL.com-timeStamping-I-RSA-R1.crl0
Source: Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV
Source: Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA468000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA481000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA47D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://crls.ssl.com/ssl.com-rsa-RootCA.crl0
Source: Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA468000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA481000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA47D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsps.ssl.com0
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ocsps.ssl.com0?
Source: Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A0D000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA468000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA481000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380788233.00000263AA47D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://4thewords.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://99designs.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://actions.moleskinestudio.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://acuityscheduling.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://acumbamail.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://admin.aftership.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://affinity.co/auth/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://airtable.com/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://alexa.amazon.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.ae
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.ca
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.cn
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.co.jp
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.co.uk
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com.au
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com.br
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com.mx/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.com.tr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.de
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.es
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.fr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.in
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.it
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.nl
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://amazon.sg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://analytics.amplitude.com/login
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://anglebug.com/7246
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://animoto.com/log_in
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.mixpanel.com/engage/?data=
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://api.mixpanel.com/track/?data=
Source: Shift Setup.tmp, 00000001.00000003.5372209955.0000000004A05000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.mixpanel.com/track/?data=eyJldmVudCI6Imluc3RhbGwiLCJwcm9wZXJ0aWVzIjp7Imluc3RhbGxfdGltZSI
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.activecollab.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.adalo.com/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.adespresso.com
Source: shift.exe, 00000007.00000003.5553038629.00004AB800C68000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.adroll.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.agantty.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.agencyanalytics.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.agorapulse.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.amazingmarvin.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.and.co/welcome
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.animaker.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.apollo.io/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://app.goabstract.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://appear.in/user/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://application.aligntoday.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/15five/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/15five/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/15five/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17hats/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17hats/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17hats/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17track/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17track/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17track/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/17track/image.svgA9https://apps.tryshiftcdn.com/17track/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1crm/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1crm/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1crm/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1password/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1password/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1password/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/1password/image.svgC;https://apps.tryshiftcdn.com/1password/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/3dcart/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/3dcart/image-color.svgRJBuild
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/3dcart/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/3dcart/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/4thewords/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/4thewords/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/4thewords/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/4thewords/image.svgC;https://apps.tryshiftcdn.com/4thewords/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/99designs/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/99designs/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/99designs/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/99designs/image.svgC;https://apps.tryshiftcdn.com/99designs/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/abstract/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/abstract/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/abstract/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/abstract/image.svgB:https://apps.tryshiftcdn.com/abstract/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/accelo/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/accelo/image-color.svgumAccelo
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/accelo/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/accelo/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acorns/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acorns/image-color.svgWOAcorns
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acorns/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acorns/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/actions/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/actions/image-color.svgjbActions
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/actions/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/actions/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/actions/image.svgA9https://apps.tryshiftcdn.com/actions/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecampaign/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecampaign/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecampaign/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecampaign/image.svgH
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecollab/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecollab/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecollab/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/activecollab/image.svgF
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acuity-scheduling/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acuity-scheduling/image-color.svgzrOnline
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acuity-scheduling/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acuity-scheduling/image.svgK
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acuity-scheduling/image.svgKChttps://apps.tryshiftcdn.com/acuity-schedu
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumatica/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumatica/image-color.svgtlAcumatica
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumatica/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumatica/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumatica/image.svgC;https://apps.tryshiftcdn.com/acumatica/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumbamail/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumbamail/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumbamail/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/acumbamail/image.svgD
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adalo/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adalo/image-color.svgwoAdalo
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adalo/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adalo/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adalo/image.svg?7https://apps.tryshiftcdn.com/adalo/image-monochrome.sv
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/addthis/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/addthis/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/addthis/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/addthis/image.svgA9https://apps.tryshiftcdn.com/addthis/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adespresso/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adespresso/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adespresso/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adespresso/image.svgD
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-acrobat-dc/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-acrobat-dc/image-color.svgLDMake
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-acrobat-dc/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-acrobat-dc/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-acrobat-dc/image.svgJBhttps://apps.tryshiftcdn.com/adobe-acrobat-
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-fonts/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-fonts/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-fonts/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-fonts/image.svgE=https://apps.tryshiftcdn.com/adobe-fonts/image-m
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-lightroom/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-lightroom/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-lightroom/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-lightroom/image.svgIAhttps://apps.tryshiftcdn.com/adobe-lightroom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-portfolio/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-portfolio/image-color.svgldQuickly
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-portfolio/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-portfolio/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-portfolio/image.svgIAhttps://apps.tryshiftcdn.com/adobe-portfolio
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-spark/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-spark/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-spark/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-spark/image.svgE=https://apps.tryshiftcdn.com/adobe-spark/image-m
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-stock/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-stock/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-stock/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adobe-stock/image.svgE=https://apps.tryshiftcdn.com/adobe-stock/image-m
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adroll/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adroll/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/adroll/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aeries/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aeries/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aeries/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/affinity/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/affinity/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/affinity/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/affinity/image.svgB:https://apps.tryshiftcdn.com/affinity/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aftership/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aftership/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aftership/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aftership/image.svgC;https://apps.tryshiftcdn.com/aftership/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agantty/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agantty/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agantty/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agantty/image.svgA9https://apps.tryshiftcdn.com/agantty/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agencyanalytics/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agencyanalytics/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agencyanalytics/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agencyanalytics/image.svgIAhttps://apps.tryshiftcdn.com/agencyanalytics
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agile-crm/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agile-crm/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agile-crm/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agile-crm/image.svgC;https://apps.tryshiftcdn.com/agile-crm/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agiled/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agiled/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agiled/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agorapulse/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agorapulse/image-color.svgzrAn
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agorapulse/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agorapulse/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/agorapulse/image.svgD
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aha/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aha/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aha/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aha/image.svg=5https://apps.tryshiftcdn.com/aha/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airbnb/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airbnb/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airbnb/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aircall/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aircall/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aircall/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aircall/image.svgA9https://apps.tryshiftcdn.com/aircall/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airmessage/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airmessage/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airmessage/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airmessage/image.svgD
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airship/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airship/image-color.svgmeAirship
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airship/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airship/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airship/image.svgA9https://apps.tryshiftcdn.com/airship/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airslate/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airslate/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airslate/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airslate/image.svgB:https://apps.tryshiftcdn.com/airslate/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airtable/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airtable/image-color.svge
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airtable/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airtable/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/airtable/image.svgB:https://apps.tryshiftcdn.com/airtable/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aisle-planner/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aisle-planner/image-color.svgd
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aisle-planner/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aisle-planner/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aisle-planner/image.svgG?https://apps.tryshiftcdn.com/aisle-planner/ima
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alchemer/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alchemer/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alchemer/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alchemer/image.svgB:https://apps.tryshiftcdn.com/alchemer/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/algolia/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/algolia/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/algolia/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/algolia/image.svgA9https://apps.tryshiftcdn.com/algolia/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alibaba/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alibaba/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alibaba/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alibaba/image.svgA9https://apps.tryshiftcdn.com/alibaba/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alienvault/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alienvault/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alienvault/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alienvault/image.svgD
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aliexpress/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aliexpress/image-color.svgtlOnline
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aliexpress/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aliexpress/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aliexpress/image.svgD
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/align-today/image-color.svgo
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/align-today/image-color.svgogAlign
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/align-today/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/align-today/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/align-today/image.svgE=https://apps.tryshiftcdn.com/align-today/image-m
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alltrails/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alltrails/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alltrails/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alltrails/image.svgC;https://apps.tryshiftcdn.com/alltrails/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alpha/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alpha/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alpha/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/alpha/image.svg?7https://apps.tryshiftcdn.com/alpha/image-monochrome.sv
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazing-marvin/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazing-marvin/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazing-marvin/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazing-marvin/image.svgH
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-alexa/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-alexa/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-alexa/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-alexa/image.svgF
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-chime/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-chime/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-chime/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-chime/image.svgF
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-music/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-music/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-music/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-music/image.svgF
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-prime-video/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-prime-video/image-color.svgiaEnjoy
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-prime-video/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-prime-video/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-prime-video/image.svgLDhttps://apps.tryshiftcdn.com/amazon-prime
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-seller-central/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-seller-central/image-color.svg_WPut
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-seller-central/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-seller-central/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-seller-central/image.svgOGhttps://apps.tryshiftcdn.com/amazon-se
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-smile/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-smile/image-color.svgmeAmazonSmile
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-smile/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-smile/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon-smile/image.svgF
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amazon/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/american-express/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/american-express/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/american-express/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/american-express/image.svgJBhttps://apps.tryshiftcdn.com/american-expre
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplenote/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplenote/image-color.svgg_Try
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplenote/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplenote/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplenote/image.svgC;https://apps.tryshiftcdn.com/amplenote/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplitude/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplitude/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplitude/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/amplitude/image.svgC;https://apps.tryshiftcdn.com/amplitude/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/andco/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/andco/image-color.svgaYInvoicing
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/andco/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/andco/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/andco/image.svg?7https://apps.tryshiftcdn.com/andco/image-monochrome.sv
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/android-messages/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/android-messages/image-color.svgSKUse
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/android-messages/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/android-messages/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/android-messages/image.svgJBhttps://apps.tryshiftcdn.com/android-messag
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anghami/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anghami/image-color.svgogAnghami
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anghami/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anghami/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anghami/image.svgA9https://apps.tryshiftcdn.com/anghami/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animaker/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animaker/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animaker/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animaker/image.svgB:https://apps.tryshiftcdn.com/animaker/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animoto/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animoto/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animoto/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/animoto/image.svgA9https://apps.tryshiftcdn.com/animoto/image-monochrom
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/answerforce/image-color.svgL
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/answerforce/image-color.svgLDAnswerForce
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/answerforce/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/answerforce/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/answerforce/image.svgE=https://apps.tryshiftcdn.com/answerforce/image-m
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565625987.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anteater/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anteater/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565625987.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anteater/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anteater/image.svgB:https://apps.tryshiftcdn.com/anteater/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565625987.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anydo/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anydo/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565625987.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anydo/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/anydo/image.svg?7https://apps.tryshiftcdn.com/anydo/image-monochrome.sv
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aol/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aol/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aol/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/aol/image.svg=5https://apps.tryshiftcdn.com/aol/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apollo/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apollo/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apollo/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-annie/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-annie/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-annie/image.svgC
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-annie/image.svgC;https://apps.tryshiftcdn.com/app-annie/image-monoc
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-store-connect/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-store-connect/image-color.svgqiEasily
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-store-connect/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-store-connect/image.svgK
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/app-store-connect/image.svgKChttps://apps.tryshiftcdn.com/app-store-con
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appcelerator/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appcelerator/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appcelerator/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appcelerator/image.svgF
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appearin/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appearin/image-color.svg~vCollaborate
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appearin/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appearin/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/appearin/image.svgB:https://apps.tryshiftcdn.com/appearin/image-monochr
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apphi/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apphi/image-color.svgXPWorld
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apphi/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apphi/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apphi/image.svg?7https://apps.tryshiftcdn.com/apphi/image-monochrome.sv
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-calendar/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-calendar/image-color.svgg_You
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-calendar/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-calendar/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-calendar/image.svgH
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-contacts/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-contacts/image-color.svgJBManage
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-contacts/image-monochrome.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-contacts/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-contacts/image.svgH
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-developer/image-color.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-developer/image-color.svg6.A
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apps.tryshiftcdn.com/apple-developer/image.svg
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://appstoreconnect.apple.com/login
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://attribution.shiftapis.com/pdata/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://aws.amazon.com/chime
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/593024
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/650547
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/655534
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://dashboard-v2.aircall.io/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5575120316.00004AB801B14000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://desktop.any.do/tasks/all
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5575120316.00004AB801B14000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://desktop.apphi.com/#/
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://forms.gle/PZRfXfGKJs9YyqNs6
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://go.airship.com/accounts/login/
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/220069903
Source: shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://issuetracker.google.com/292285899
Source: Shift Setup.exe, 00000000.00000000.5025701034.0000000000401000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://login.aol.com/?src=mail
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://messages.google.com/web
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://music.amazon.ca/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://my.15five.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://my.agiled.app/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://my.airslate.com
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5364683714.000063E000244000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80
Source: Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://platform.alphahq.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://platform.axway.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portal.acumatica.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://secure.aha.io/session/new
Source: shift.exe, 00000007.00000003.5554770847.00004AB8004EC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410210101/pubads_impl.js
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.ae/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.ca/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.co.jp/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.co.uk/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.co.uk/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.com.au/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.com.mx/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.com.tr/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.com/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.de/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.es/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.fr/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.in/(
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sellercentral.amazon.it/
Source: shift.exe, 00000007.00000003.5554770847.00004AB8004EC000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5453436392.00004AB801060000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551837376.00004AB800EE0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5458063150.00004AB8010EC000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551425125.00004AB800654000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551746296.00004AB8011A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5514851350.00004AB800654000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5453103456.00004AB8010A0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5507935767.00004AB800C8C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shiftntp.com/
Source: shift.exe, 00000007.00000003.5414403535.00004AB800F34000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551837376.00004AB800EE0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570035673.00004AB800EE0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551935041.00004AB8002A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551746296.00004AB8011A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5453103456.00004AB8010A0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5563112636.00004AB800654000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5414081878.00004AB801010000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shiftntp.com/g
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://signin.acorns.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://smile.amazon.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://start.1password.com
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tryshift.com
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tryshift.com/eula
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tryshift.com/privacy
Source: Shift Setup.tmp, 00000001.00000003.5062480028.00000000009D9000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5376330839.00000263A5CCE000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5374689076.00000263A5CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/ip/
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/preflight
Source: Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/preflightE
Source: Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/preflightq
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380109183.00000263A5CCE000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5376330839.00000263A5CCE000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5374689076.00000263A5CCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/settings
Source: Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/settings4
Source: Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A16000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/settingswserift_browser
Source: Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A3C000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5062480028.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A28000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5376330839.00000263A5CB6000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5375446856.00000263A5CB6000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380109183.00000263A5CB6000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5374689076.00000263A5CB6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/splittests
Source: Shift Setup.tmp, 00000001.00000003.5054837069.0000000000A3C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/splittestsWM1
Source: Shift Setup.tmp, 00000001.00000003.5054837069.00000000009F4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://updates.shiftapis.com/splittestsq
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://user.17track.net
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://web.airmessage.org/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.17hats.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.3dcart.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.addthis.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aeries.com/products/portals
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.airbnb.com
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aisleplanner.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.alchemer.com/account-logins/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.algolia.com/users/sign_in
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.alibaba.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.alienvault.com/accounts/signin/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.alltrails.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.americanexpress.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.amplenote.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.anghami.com/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.answerforce.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565625987.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.anteateranalytics.com/dash/intro
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.appannie.com/account/login
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5575120316.00004AB801B14000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.icloud.com/calendar/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5575120316.00004AB801B14000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.icloud.com/contacts/
Source: Shift Setup.exe, 00000000.00000003.5027372174.0000000002850000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.exe, 00000000.00000003.5028085278.000000007FAF0000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000000.5030848129.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
Source: shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.primevideo.com/
Source: Shift Setup.exe, 00000000.00000003.5027372174.0000000002850000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.exe, 00000000.00000003.5028085278.000000007FAF0000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000000.5030848129.0000000000401000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
Source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ssl.com/repository0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DDA8208_2_00007FF678DDA820
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DDBE328_2_00007FF678DDBE32
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD3A008_2_00007FF678DD3A00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DDBF008_2_00007FF678DDBF00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DDAAE08_2_00007FF678DDAAE0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD3DF08_2_00007FF678DD3DF0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DDBBC08_2_00007FF678DDBBC0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DDB1808_2_00007FF678DDB180
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD3F908_2_00007FF678DD3F90
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD275E8_2_00007FF678DD275E
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD5C608_2_00007FF678DD5C60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD17608_2_00007FF678DD1760
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD32608_2_00007FF678DD3260
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678DD3B608_2_00007FF678DD3B60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB43A008_2_00007FFE3EB43A00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4BF008_2_00007FFE3EB4BF00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4A8208_2_00007FFE3EB4A820
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4BE328_2_00007FFE3EB4BE32
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4BBC08_2_00007FFE3EB4BBC0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4AAE08_2_00007FFE3EB4AAE0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB43DF08_2_00007FFE3EB43DF0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4B1808_2_00007FFE3EB4B180
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB43F908_2_00007FFE3EB43F90
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB417608_2_00007FFE3EB41760
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB432608_2_00007FFE3EB43260
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB43B608_2_00007FFE3EB43B60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB45C608_2_00007FFE3EB45C60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FFE3EB4275E8_2_00007FFE3EB4275E
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DDA8209_2_00007FF678DDA820
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DDBE329_2_00007FF678DDBE32
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD3A009_2_00007FF678DD3A00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DDBF009_2_00007FF678DDBF00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DDAAE09_2_00007FF678DDAAE0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD3DF09_2_00007FF678DD3DF0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DDBBC09_2_00007FF678DDBBC0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DDB1809_2_00007FF678DDB180
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD3F909_2_00007FF678DD3F90
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD275E9_2_00007FF678DD275E
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD5C609_2_00007FF678DD5C60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD17609_2_00007FF678DD1760
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD32609_2_00007FF678DD3260
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 9_2_00007FF678DD3B609_2_00007FF678DD3B60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DDA82017_2_00007FF678DDA820
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DDBE3217_2_00007FF678DDBE32
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD3A0017_2_00007FF678DD3A00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DDBF0017_2_00007FF678DDBF00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DDAAE017_2_00007FF678DDAAE0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD3DF017_2_00007FF678DD3DF0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DDBBC017_2_00007FF678DDBBC0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DDB18017_2_00007FF678DDB180
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD3F9017_2_00007FF678DD3F90
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD275E17_2_00007FF678DD275E
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD5C6017_2_00007FF678DD5C60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD176017_2_00007FF678DD1760
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD326017_2_00007FF678DD3260
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 17_2_00007FF678DD3B6017_2_00007FF678DD3B60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DDA82019_2_00007FF678DDA820
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DDBE3219_2_00007FF678DDBE32
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD3A0019_2_00007FF678DD3A00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DDBF0019_2_00007FF678DDBF00
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DDAAE019_2_00007FF678DDAAE0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD3DF019_2_00007FF678DD3DF0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DDBBC019_2_00007FF678DDBBC0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DDB18019_2_00007FF678DDB180
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD3F9019_2_00007FF678DD3F90
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD275E19_2_00007FF678DD275E
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD5C6019_2_00007FF678DD5C60
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD176019_2_00007FF678DD1760
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD326019_2_00007FF678DD3260
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 19_2_00007FF678DD3B6019_2_00007FF678DD3B60
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2700
Source: Shift Setup.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-HTN68.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: setup.exe.7.drStatic PE information: Number of sections : 12 > 10
Source: is-7N7R4.tmp.1.drStatic PE information: Number of sections : 12 > 10
Source: shift.dll.33.drStatic PE information: Number of sections : 15 > 10
Source: notification_helper.exe.33.drStatic PE information: Number of sections : 11 > 10
Source: is-ACQJB.tmp.1.drStatic PE information: Number of sections : 11 > 10
Source: is-1QBQG.tmp.1.drStatic PE information: Number of sections : 11 > 10
Source: is-NH3GK.tmp.1.drStatic PE information: Number of sections : 11 > 10
Source: is-EISFN.tmp.1.drStatic PE information: Number of sections : 14 > 10
Source: eventlog_provider.dll.33.drStatic PE information: No import functions for PE file found
Source: Shift Setup.exe, 00000000.00000003.5027372174.000000000293A000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs Shift Setup.exe
Source: Shift Setup.exe, 00000000.00000000.5026053812.00000000004C6000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs Shift Setup.exe
Source: Shift Setup.exe, 00000000.00000003.5028085278.000000007FDD6000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs Shift Setup.exe
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeRegistry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\91.0.1 (x64 en-GB)\Main Install DirectoryJump to behavior
Source: Shift Setup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engineClassification label: sus26.spyw.evad.winEXE@54/762@0/28
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile created: C:\Program Files\chrome_BITS_9184_1433764606Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\ProgramsJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpMutant created: \Sessions\1\BaseNamedObjects\ShiftSetup-1c730e63-6e5f-40e0-80ac-ea3d2e84e629
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpMutant created: \Sessions\1\BaseNamedObjects\Shift-841bfdc9-095f-4be3-9a77-bce0d18a78a8
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9112:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeMutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8824:304:WilStaging_02
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\ChromeSetupMutex_15565684959804090210
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9112:120:WilError_03
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeMutant created: \Sessions\1\BaseNamedObjects\Global\ChromeSetupExitEventMutex_15565684959804090210
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeMutant created: \Sessions\1\BaseNamedObjects\Local\ChromeProcessSingletonStartup!
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8824:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8548
Source: C:\Users\user\Desktop\Shift Setup.exeFile created: C:\Users\user\AppData\Local\Temp\is-163NS.tmpJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "shift.exe")
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: shift.exe, 00000007.00000003.5372085500.00004AB8007D8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5372369718.00004AB800794000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: C:\Users\user\Desktop\Shift Setup.exeFile read: C:\Users\user\Desktop\Shift Setup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\Shift Setup.exe "C:\Users\user\Desktop\Shift Setup.exe"
Source: C:\Users\user\Desktop\Shift Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp "C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp" /SL5="$10468,95019598,1164800,C:\Users\user\Desktop\Shift Setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im shift.exe
Source: C:\Windows\SysWOW64\taskkill.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\System32\schtasks.exe "schtasks" /delete /tn ShiftLaunchTask /f
Source: C:\Windows\System32\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --start-maximized
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: unknownProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --start-maximized --launch-source=sign-in
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2700
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2444
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe setup.exe --do-not-launch-chrome
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe "C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\Desktop\Shift Setup.exeProcess created: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp "C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp" /SL5="$10468,95019598,1164800,C:\Users\user\Desktop\Shift Setup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im shift.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\System32\schtasks.exe "schtasks" /delete /tn ShiftLaunchTask /fJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --start-maximizedJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe setup.exe --do-not-launch-chromeJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
Source: C:\Windows\explorer.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe "C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\Desktop\Shift Setup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Shift Setup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: winhttpcom.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: msftedit.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: windows.globalization.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: bcp47mrm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: globinputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: sfc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: sfc_os.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kbdus.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: webio.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: twinapi.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: twinapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: schannel.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: windows.ui.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: windowmanagementapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: inputhost.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mscms.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: coloradapterclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mdmregistration.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: devobj.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: omadmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dmcmnutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iri.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mmdevapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dsreg.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wpnapps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rmclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: xmllite.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: usermgrcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: firewallapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: fwbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: taskschd.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dataexchange.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: d3d11.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dcomp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dxgi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: windows.media.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: directmanipulation.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wlanapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: perfos.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: pcpksp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: tbs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ncryptprov.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptowinrt.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptngc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ngcksp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: bitsproxy.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dcomp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dxcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dxil.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: d3d12.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winpixeventruntime.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: webio.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwritecore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwritecore.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: pcacli.dll
Source: C:\Windows\explorer.exeSection loaded: mpr.dll
Source: C:\Windows\explorer.exeSection loaded: sfc_os.dll
Source: C:\Windows\explorer.exeSection loaded: storageusage.dll
Source: C:\Windows\explorer.exeSection loaded: fhcfg.dll
Source: C:\Windows\explorer.exeSection loaded: efsutil.dll
Source: C:\Windows\explorer.exeSection loaded: dsrole.dll
Source: C:\Windows\explorer.exeSection loaded: windows.internal.system.userprofile.dll
Source: C:\Windows\explorer.exeSection loaded: cloudexperiencehostbroker.dll
Source: C:\Windows\explorer.exeSection loaded: credui.dll
Source: C:\Windows\explorer.exeSection loaded: dui70.dll
Source: C:\Windows\explorer.exeSection loaded: wdscore.dll
Source: C:\Windows\explorer.exeSection loaded: dbghelp.dll
Source: C:\Windows\explorer.exeSection loaded: dbgcore.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp140.dll
Source: C:\Windows\explorer.exeSection loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: firewallapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: fwbase.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: fwpolicyiomgr.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: edgegdi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2087c2f4-2cef-4953-a8ab-66779b670495}\InProcServer32Jump to behavior
Source: Shift Browser.lnk.1.drLNK file: ..\AppData\Local\Shift\chromium\shift.exe
Source: Shift Browser.lnk0.1.drLNK file: ..\..\..\..\..\..\Local\Shift\chromium\shift.exe
Source: Shift.lnk.36.drLNK file: ..\AppData\Local\Shift\chromium\shift.exe
Source: Shift.lnk0.36.drLNK file: ..\..\..\..\Local\Shift\chromium\shift.exe
Source: Shift.lnk1.36.drLNK file: ..\..\..\..\..\Local\Shift\chromium\shift.exe
Source: Shift.lnk2.36.drLNK file: ..\..\..\..\..\Local\Shift\chromium\shift.exe
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpWindow found: window name: TMainFormJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpAutomated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Windows\SysWOW64\MSFTEDIT.DLLJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeKey opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\Outlook\Capabilities\UrlAssociations
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeDirectory created: C:\Program Files\chrome_BITS_9184_1433764606Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{95fcf903-63b1-44bd-ab77-358a5bd30aae}_is1Jump to behavior
Source: Shift Setup.exeStatic PE information: certificate valid
Source: Shift Setup.exeStatic file information: File size 96211664 > 1048576
Source: Shift Setup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\initialexe\shift.exe.pdb source: shift.exe, 00000007.00000000.5353689043.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\shift_elf.dll.pdb source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\shift_pwa_launcher.exe.pdb source: Shift Setup.tmp, 00000001.00000003.5381387856.0000000003ED5000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\_gha\shift-browser\shift-browser\release\base\src\out\Release\shift_wer.dll.pdb source: Shift Setup.tmp, 00000001.00000003.5381387856.000000000401E000.00000004.00001000.00020000.00000000.sdmp
Source: is-EUCDG.tmp.1.drStatic PE information: 0x831FAD3B [Sat Sep 17 16:54:19 2039 UTC]
Source: Shift Setup.exeStatic PE information: section name: .didata
Source: Shift Setup.tmp.0.drStatic PE information: section name: .didata
Source: is-HTN68.tmp.1.drStatic PE information: section name: .didata
Source: is-IU081.tmp.1.drStatic PE information: section name: .gxfg
Source: is-IU081.tmp.1.drStatic PE information: section name: .retplne
Source: is-IU081.tmp.1.drStatic PE information: section name: _RDATA
Source: is-31OF2.tmp.1.drStatic PE information: section name: .gxfg
Source: is-31OF2.tmp.1.drStatic PE information: section name: .retplne
Source: is-31OF2.tmp.1.drStatic PE information: section name: _RDATA
Source: is-KAIME.tmp.1.drStatic PE information: section name: .gxfg
Source: is-KAIME.tmp.1.drStatic PE information: section name: .retplne
Source: is-KAIME.tmp.1.drStatic PE information: section name: _RDATA
Source: is-NH3GK.tmp.1.drStatic PE information: section name: .gxfg
Source: is-NH3GK.tmp.1.drStatic PE information: section name: .retplne
Source: is-NH3GK.tmp.1.drStatic PE information: section name: CPADinfo
Source: is-NH3GK.tmp.1.drStatic PE information: section name: _RDATA
Source: is-MVLTH.tmp.1.drStatic PE information: section name: .gxfg
Source: is-MVLTH.tmp.1.drStatic PE information: section name: .retplne
Source: is-MVLTH.tmp.1.drStatic PE information: section name: _RDATA
Source: is-G1855.tmp.1.drStatic PE information: section name: .gxfg
Source: is-G1855.tmp.1.drStatic PE information: section name: .retplne
Source: is-G1855.tmp.1.drStatic PE information: section name: _RDATA
Source: is-1QBQG.tmp.1.drStatic PE information: section name: .gxfg
Source: is-1QBQG.tmp.1.drStatic PE information: section name: .retplne
Source: is-1QBQG.tmp.1.drStatic PE information: section name: CPADinfo
Source: is-1QBQG.tmp.1.drStatic PE information: section name: _RDATA
Source: is-HDHJ0.tmp.1.drStatic PE information: section name: .gxfg
Source: is-HDHJ0.tmp.1.drStatic PE information: section name: .retplne
Source: is-HDHJ0.tmp.1.drStatic PE information: section name: _RDATA
Source: is-EISFN.tmp.1.drStatic PE information: section name: .gxfg
Source: is-EISFN.tmp.1.drStatic PE information: section name: .retplne
Source: is-EISFN.tmp.1.drStatic PE information: section name: .rodata
Source: is-EISFN.tmp.1.drStatic PE information: section name: CPADinfo
Source: is-EISFN.tmp.1.drStatic PE information: section name: LZMADEC
Source: is-EISFN.tmp.1.drStatic PE information: section name: _RDATA
Source: is-EISFN.tmp.1.drStatic PE information: section name: malloc_h
Source: is-7N7R4.tmp.1.drStatic PE information: section name: .crthunk
Source: is-7N7R4.tmp.1.drStatic PE information: section name: .gxfg
Source: is-7N7R4.tmp.1.drStatic PE information: section name: .retplne
Source: is-7N7R4.tmp.1.drStatic PE information: section name: CPADinfo
Source: is-7N7R4.tmp.1.drStatic PE information: section name: _RDATA
Source: is-ACQJB.tmp.1.drStatic PE information: section name: .gxfg
Source: is-ACQJB.tmp.1.drStatic PE information: section name: .retplne
Source: is-ACQJB.tmp.1.drStatic PE information: section name: LZMADEC
Source: is-ACQJB.tmp.1.drStatic PE information: section name: _RDATA
Source: is-2V23J.tmp.1.drStatic PE information: section name: .gxfg
Source: is-2V23J.tmp.1.drStatic PE information: section name: .retplne
Source: is-2V23J.tmp.1.drStatic PE information: section name: _RDATA
Source: setup.exe.7.drStatic PE information: section name: .gxfg
Source: setup.exe.7.drStatic PE information: section name: .retplne
Source: setup.exe.7.drStatic PE information: section name: CPADinfo
Source: setup.exe.7.drStatic PE information: section name: LZMADEC
Source: setup.exe.7.drStatic PE information: section name: _RDATA
Source: mojo_core.dll.33.drStatic PE information: section name: .gxfg
Source: mojo_core.dll.33.drStatic PE information: section name: .retplne
Source: mojo_core.dll.33.drStatic PE information: section name: _RDATA
Source: notification_helper.exe.33.drStatic PE information: section name: .gxfg
Source: notification_helper.exe.33.drStatic PE information: section name: .retplne
Source: notification_helper.exe.33.drStatic PE information: section name: CPADinfo
Source: notification_helper.exe.33.drStatic PE information: section name: _RDATA
Source: shift.dll.33.drStatic PE information: section name: .gxfg
Source: shift.dll.33.drStatic PE information: section name: .retplne
Source: shift.dll.33.drStatic PE information: section name: .rodata
Source: shift.dll.33.drStatic PE information: section name: CPADinfo
Source: shift.dll.33.drStatic PE information: section name: LZMADEC
Source: shift.dll.33.drStatic PE information: section name: _RDATA
Source: shift.dll.33.drStatic PE information: section name: malloc_h
Source: shift.dll.33.drStatic PE information: section name: prot
Source: dxcompiler.dll.33.drStatic PE information: section name: .gxfg
Source: dxcompiler.dll.33.drStatic PE information: section name: .retplne
Source: dxcompiler.dll.33.drStatic PE information: section name: _RDATA
Source: dxil.dll.33.drStatic PE information: section name: _RDATA
Source: eventlog_provider.dll.33.drStatic PE information: section name: .retplne
Source: libEGL.dll.33.drStatic PE information: section name: .gxfg
Source: libEGL.dll.33.drStatic PE information: section name: .retplne
Source: libEGL.dll.33.drStatic PE information: section name: _RDATA
Source: libGLESv2.dll.33.drStatic PE information: section name: .gxfg
Source: libGLESv2.dll.33.drStatic PE information: section name: .retplne
Source: libGLESv2.dll.33.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\is-1QBQG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\Win32Library.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\d3dcompiler_47.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vk_swiftshader.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxil.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\is-HDHJ0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-IU081.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-NH3GK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-KAIME.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\mojo_core.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_elf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_wer.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vulkan-1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\notification_helper.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-31OF2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-MVLTH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-G1855.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\is-HTN68.tmpJump to dropped file
Source: C:\Users\user\Desktop\Shift Setup.exeFile created: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxcompiler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\chromium\new_shift_proxy.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_pwa_launcher.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-2V23J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-7N7R4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\shift_proxy.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libEGL.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\shift.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libGLESv2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\mojo_core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\eventlog_provider.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-ACQJB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EUCDG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EISFN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Local\Temp\chromium_installer.log

Boot Survival

barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\System32\schtasks.exe "schtasks" /delete /tn ShiftLaunchTask /f
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ShiftJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shift\Shift Browser.lnkJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shift.lnk
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShiftAutoLaunch_53CF6764BCE293C804D7A1CE3A191AD0Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ShiftAutoLaunch_53CF6764BCE293C804D7A1CE3A191AD0Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Taskband FavoritesResolve
Source: C:\Users\user\Desktop\Shift Setup.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeSystem information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpMemory allocated: 6570000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpMemory allocated: 6830000 memory reserve | memory write watchJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpMemory allocated: 6570000 memory reserve | memory write watchJump to behavior
Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 740
Source: C:\Windows\explorer.exeWindow / User API: foregroundWindowGot 714
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\d3dcompiler_47.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\d3dcompiler_47.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\Win32Library.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vk_swiftshader.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libGLESv2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\is-HDHJ0.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-IU081.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-NH3GK.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\mojo_core.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-KAIME.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_elf.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vulkan-1.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\_isetup\_setup64.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\notification_helper.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libEGL.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-MVLTH.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-31OF2.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-G1855.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\is-HTN68.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxcompiler.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_pwa_launcher.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-2V23J.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-7N7R4.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\shift_proxy.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libEGL.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\shift.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\unins000.exe (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\mojo_core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libGLESv2.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift.dll (copy)Jump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\eventlog_provider.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-ACQJB.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\notification_helper.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EUCDG.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EISFN.tmpJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp TID: 8620Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp TID: 8600Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp TID: 8620Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exe TID: 5832Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exe TID: 8796Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeKey opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010409Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT HypervisorPresent FROM Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\webui_js FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\wasm FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\wasm FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\webui_js FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\js FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\blob_storage\f4939d9c-1111-4ca7-bbea-6c299921280f FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def FullSizeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\chromium FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Shift\chromium FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile Volume queried: C:\Users\user FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\Local\Shift\chromiumJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\LocalJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\Local\Shift\chromium\shift.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpFile opened: C:\Users\user\AppData\Local\ShiftJump to behavior
Source: Shift Setup.tmp, 00000001.00000003.5062480028.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5048038532.00000000009F0000.00000004.00000020.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5054837069.00000000009FB000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5374689076.00000263A5D07000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5380109183.00000263A5D07000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5371448021.00000263A95BA000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5376330839.00000263A5D07000.00000004.00000020.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5375446856.00000263A5D07000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess queried: DebugPortJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess queried: DebugPortJump to behavior
Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpMemory allocated: page read and write | page guardJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im shift.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --start-maximizedJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dllJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeFile opened: Windows Firewall: C:\Windows\System32\FirewallAPI.dll
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpProcess created: C:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im shift.exeJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe c:\users\user\appdata\local\shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\shift\user data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=c:\users\user\appdata\local\shift\user data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe c:\users\user\appdata\local\shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\shift\user data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.profileimport --lang=en-us --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.processormetrics --lang=en-us --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe c:\users\user\appdata\local\shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe c:\users\user\appdata\local\shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadoaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaabeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe c:\users\user\appdata\local\shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\shift\user data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=c:\users\user\appdata\local\shift\user data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.profileimport --lang=en-us --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-us --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.processormetrics --lang=en-us --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe "c:\users\user\appdata\local\shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=waaaaaaaaadoaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaabeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8Jump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\shift.exe c:\users\user\appdata\local\shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\shift\user data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe c:\users\user\appdata\local\shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeProcess created: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe c:\users\user\appdata\local\shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\shift\user data\crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=win64 --annotation=prod=shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\Win32Library.dll VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\exit-10-light.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\min-10-light.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\shift.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-10-light.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\checkmark-10-light.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-cancel-10-light.png VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\split-tests.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\server-settings.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\install-info.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\MEIPreload\manifest.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\split-tests.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\server-settings.json VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\3db352a1dba26740_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\DNR Extension Rules\mofjdkplmlofiadhjjcacadmghmaglna\rules.fbs VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\MEIPreload\preloaded_data.pb VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\438df0bf0cadf176_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\dbeb473c1e234f08_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\067ebc3d83f706c1_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\9da5ee6eb934f719_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\4a439cb3f3eea072_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\d35c3e2a3ca098b6_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\15e4706dadbff920_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\4c7f7b1849963808_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\ac7d1e531e15eb97_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\ad3ce3c67c00ad4a_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\2b724b4a3325367a_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\239cceb8ac752bc0_0 VolumeInformationJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\split-tests.json VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\server-settings.json VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\install-info.json VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Users\user\AppData\Local\Shift\chromium\.configurations\server-settings.json VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exeQueries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeQueries volume information: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\igdlh.cat VolumeInformation
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeCode function: 8_2_00007FF678F23034 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,8_2_00007FF678F23034
Source: C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Shift\chromium\shift.exeFile opened: C:\Users\user\AppData\Local\Shift\User Data\Default\HistoryJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts31
Windows Management Instrumentation		1
DLL Side-Loading		1
DLL Side-Loading		21
Disable or Modify Tools		1
OS Credential Dumping		1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
DLL Search Order Hijacking		1
DLL Search Order Hijacking		1
Timestomp		LSASS Memory2
File and Directory Discovery		Remote Desktop Protocol1
Browser Session Hijacking		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Scheduled Task/Job		1
Windows Service		1
Windows Service		1
DLL Side-Loading		Security Account Manager46
System Information Discovery		SMB/Windows Admin Shares1
Data from Local System		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
Scheduled Task/Job		11
Process Injection		1
DLL Search Order Hijacking		NTDS131
Security Software Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchd11
Registry Run Keys / Startup Folder		1
Scheduled Task/Job		3
Masquerading		LSA Secrets15
Virtualization/Sandbox Evasion		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
Registry Run Keys / Startup Folder		1
Modify Registry		Cached Domain Credentials1
Process Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items15
Virtualization/Sandbox Evasion		DCSync1
Application Window Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
Process Injection		Proc Filesystem2
System Owner/User Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow1
Remote System Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1541415 Sample: Shift Setup.exe Startdate: 24/10/2024 Architecture: WINDOWS Score: 26 95 Uses schtasks.exe or at.exe to add and modify task schedules 2->95 10 Shift Setup.exe 2 2->10         started        13 shift.exe 2->13         started        process3 file4 77 C:\Users\user\AppData\...\Shift Setup.tmp, PE32 10->77 dropped 15 Shift Setup.tmp 57 218 10->15         started        process5 dnsIp6 91 35.186.241.51 GOOGLEUS United States 15->91 93 3.140.172.47 AMAZON-02US United States 15->93 57 C:\Users\user\AppData\...\shift.exe (copy), PE32+ 15->57 dropped 59 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 15->59 dropped 61 C:\Users\user\AppData\...\Win32Library.dll, PE32 15->61 dropped 63 27 other files (none is malicious) 15->63 dropped 19 shift.exe 32 404 15->19         started        24 taskkill.exe 1 15->24         started        26 schtasks.exe 1 15->26         started        28 2 other processes 15->28 file7 process8 dnsIp9 79 3.131.25.94 AMAZON-02US United States 19->79 81 239.255.255.250 unknown Reserved 19->81 73 C:\Users\user\AppData\Local\Shift\...\History, SQLite 19->73 dropped 75 C:\Users\user\AppData\Local\...\setup.exe, PE32+ 19->75 dropped 97 Tries to harvest and steal browser information (history, passwords, etc) 19->97 30 shift.exe 19->30         started        33 shift.exe 19->33         started        35 setup.exe 19->35         started        42 12 other processes 19->42 38 conhost.exe 24->38         started        40 conhost.exe 26->40         started        83 20.42.65.92 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 28->83 file10 signatures11 process12 dnsIp13 99 Tries to harvest and steal browser information (history, passwords, etc) 30->99 101 Query firmware table information (likely to detect VMs) 33->101 65 C:\Users\user\...\new_shift_proxy.exe (copy), PE32+ 35->65 dropped 67 C:\Users\user\AppData\Local\...\shift.dll, PE32+ 35->67 dropped 69 C:\Users\user\...\notification_helper.exe, PE32+ 35->69 dropped 71 7 other files (none is malicious) 35->71 dropped 45 setup.exe 35->45         started        47 setup.exe 35->47         started        85 18.164.96.46 MIT-GATEWAYSUS United States 42->85 87 18.173.132.52 MIT-GATEWAYSUS United States 42->87 89 21 other IPs or domains 42->89 49 shift.exe 42->49         started        51 shift.exe 42->51         started        53 shift.exe 42->53         started        file14 signatures15 process16 process17 55 setup.exe 45->55         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Shift Setup.exe0%ReversingLabs

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\d3dcompiler_47.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxcompiler.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxil.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\eventlog_provider.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libEGL.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libGLESv2.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\mojo_core.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\notification_helper.exe0%ReversingLabs
C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\shift.dll0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\d3dcompiler_47.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-2V23J.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-31OF2.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-7N7R4.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-ACQJB.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EISFN.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EUCDG.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-G1855.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-IU081.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-KAIME.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-MVLTH.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-NH3GK.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libEGL.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libGLESv2.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\mojo_core.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\notification_helper.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_elf.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_pwa_launcher.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_wer.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vk_swiftshader.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vulkan-1.dll (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\is-1QBQG.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\is-HDHJ0.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\new_shift_proxy.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\shift.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\chromium\shift_proxy.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Shift\is-HTN68.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Shift\unins000.exe (copy)0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\Win32Library.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\_isetup\_setup64.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://apps.tryshiftcdn.com/answerforce/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
    		unknown
    https://acumbamail.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
      		unknown
      https://apps.tryshiftcdn.com/acorns/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
        		unknown
        https://amazon.co.ukshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
          		unknown
          https://apps.tryshiftcdn.com/agorapulse/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
            		unknown
            https://apps.tryshiftcdn.com/aeries/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
              		unknown
              http://ocsps.ssl.com0?Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpfalse
                		unknown
                http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt0Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpfalse
                  		unknown
                  https://actions.moleskinestudio.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                    		unknown
                    https://apps.tryshiftcdn.com/amazon-prime-video/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                      		unknown
                      https://apps.tryshiftcdn.com/anghami/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                        		unknown
                        https://apps.tryshiftcdn.com/actions/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                          		unknown
                          http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_Shift Setup.tmp, 00000001.00000003.5381387856.0000000003A80000.00000004.00001000.00020000.00000000.sdmpfalse
                            		unknown
                            https://sellercentral.amazon.co.uk/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                              		unknown
                              https://apps.tryshiftcdn.com/align-today/image-color.svgoshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                		unknown
                                https://apps.tryshiftcdn.com/agencyanalytics/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://apps.tryshiftcdn.com/android-messages/image.svgJBhttps://apps.tryshiftcdn.com/android-messagshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://www.answerforce.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://apps.tryshiftcdn.com/adobe-fonts/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://apps.tryshiftcdn.com/answerforce/image-color.svgLshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://amazon.sgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565947286.00004AB801A40000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		unknown
                                            https://www.primevideo.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		unknown
                                              https://apps.tryshiftcdn.com/abstract/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://www.airbnb.comshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://sellercentral.amazon.in/(shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    https://apps.tryshiftcdn.com/agile-crm/image.svgCshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://apps.tryshiftcdn.com/amazon-smile/image.svgFshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://apps.tryshiftcdn.com/android-messages/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          https://apps.tryshiftcdn.com/appcelerator/image.svgFshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            https://apps.tryshiftcdn.com/acumbamail/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              https://apps.tryshiftcdn.com/alchemer/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                https://www.innosetup.com/Shift Setup.exe, 00000000.00000003.5027372174.0000000002850000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.exe, 00000000.00000003.5028085278.000000007FAF0000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000000.5030848129.0000000000401000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                  		unknown
                                                                  https://apps.tryshiftcdn.com/anydo/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5565625987.00004AB801AB4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                    		unknown
                                                                    https://shiftntp.com/shift.exe, 00000007.00000003.5554770847.00004AB8004EC000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5453436392.00004AB801060000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551837376.00004AB800EE0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5458063150.00004AB8010EC000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551425125.00004AB800654000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551746296.00004AB8011A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5514851350.00004AB800654000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5453103456.00004AB8010A0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5507935767.00004AB800C8C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      https://apps.tryshiftcdn.com/adobe-acrobat-dc/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://affinity.co/auth/loginshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://apps.tryshiftcdn.com/app-annie/image.svgC;https://apps.tryshiftcdn.com/app-annie/image-monocshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            https://apps.tryshiftcdn.com/adobe-spark/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              https://anglebug.com/7246shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                https://apps.tryshiftcdn.com/app-store-connect/image.svgKChttps://apps.tryshiftcdn.com/app-store-conshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  https://crbug.com/593024shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    https://apps.tryshiftcdn.com/adalo/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://apps.tryshiftcdn.com/aol/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://apps.tryshiftcdn.com/amazon-smile/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://sellercentral.amazon.com.tr/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            https://apps.tryshiftcdn.com/affinity/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://apps.tryshiftcdn.com/adobe-stock/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                https://apps.tryshiftcdn.com/adobe-fonts/image.svgE=https://apps.tryshiftcdn.com/adobe-fonts/image-mshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://anglebug.com/1452shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://my.airslate.comshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://apps.tryshiftcdn.com/aftership/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://appear.in/user/loginshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://apps.tryshiftcdn.com/aol/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5556462212.00004AB8004A4000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5555158660.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5553725309.00004AB800978000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554036437.00004AB801D4C000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://apps.tryshiftcdn.com/apple-developer/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              https://apps.tryshiftcdn.com/amazon-seller-central/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://sellercentral.amazon.de/(shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://apps.tryshiftcdn.com/activecampaign/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://apps.tryshiftcdn.com/amazing-marvin/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://apps.tryshiftcdn.com/agile-crm/image.svgC;https://apps.tryshiftcdn.com/agile-crm/image-monocshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        https://apps.tryshiftcdn.com/airtable/image.svgB:https://apps.tryshiftcdn.com/airtable/image-monochrshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://apps.tryshiftcdn.com/aol/image.svg=5https://apps.tryshiftcdn.com/aol/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://apps.tryshiftcdn.com/app-store-connect/image-color.svgqiEasilyshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://apps.tryshiftcdn.com/amazon/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://apps.tryshiftcdn.com/affinity/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5552640931.00004AB8008B8000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://apps.tryshiftcdn.com/agencyanalytics/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://apps.tryshiftcdn.com/amplenote/image.svgC;https://apps.tryshiftcdn.com/amplenote/image-monocshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://apps.tryshiftcdn.com/andco/image.svg?7https://apps.tryshiftcdn.com/andco/image-monochrome.svshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://www.17hats.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://apps.tryshiftcdn.com/amazon-alexa/image.svgFshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://apps.tryshiftcdn.com/apple-calendar/image.svgHshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://tryshift.comShift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://apps.tryshiftcdn.com/anghami/image.svgA9https://apps.tryshiftcdn.com/anghami/image-monochromshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://4thewords.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://apps.tryshiftcdn.com/animaker/image.svgB:https://apps.tryshiftcdn.com/animaker/image-monochrshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      https://apps.tryshiftcdn.com/4thewords/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://apps.tryshiftcdn.com/amplitude/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          https://apps.tryshiftcdn.com/airship/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://apps.tryshiftcdn.com/17track/image.svgA9https://apps.tryshiftcdn.com/17track/image-monochromshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              https://apps.tryshiftcdn.com/adalo/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://sellercentral.amazon.co.jp/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://apps.tryshiftcdn.com/adobe-acrobat-dc/image.svgJBhttps://apps.tryshiftcdn.com/adobe-acrobat-shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://www.alltrails.com/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://apps.tryshiftcdn.com/alienvault/image.svgDshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://apps.tryshiftcdn.com/apple-contacts/image-color.svgJBManageshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://apps.tryshiftcdn.com/amazon-smile/image-color.svgmeAmazonSmileshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://apps.tryshiftcdn.com/3dcart/image-color.svgRJBuildshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://updates.shiftapis.com/ip/Shift Setup.exe, 00000000.00000003.5026371623.0000000002710000.00000004.00001000.00020000.00000000.sdmp, Shift Setup.tmp, 00000001.00000003.5033032832.00000000036E0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                https://apps.tryshiftcdn.com/app-store-connect/image.svgKshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574773067.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562870523.00004AB802412000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571630260.00004AB801EF6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  https://apps.tryshiftcdn.com/airmessage/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    https://web.airmessage.org/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://apps.tryshiftcdn.com/amazon-seller-central/image-monochrome.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://start.1password.comshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://apps.tryshiftcdn.com/aha/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            https://apps.tryshiftcdn.com/aisle-planner/image.svgG?https://apps.tryshiftcdn.com/aisle-planner/imashift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              https://apps.tryshiftcdn.com/adobe-acrobat-dc/image.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570350933.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557493181.00004AB8022F6000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557648407.00004AB802306000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                http://anglebug.com/8297shift.exe, 00000007.00000003.5376616336.00004AB800B40000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown
                                                                                                                                                                                                  https://apps.tryshiftcdn.com/aftership/image.svgCshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		unknown
                                                                                                                                                                                                    https://desktop.apphi.com/#/shift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5575120316.00004AB801B14000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5551402772.00004AB801404000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		unknown
                                                                                                                                                                                                      https://www.anghami.com/loginshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5559618804.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557092482.00004AB801FC0000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		unknown
                                                                                                                                                                                                        https://apps.tryshiftcdn.com/adobe-portfolio/image-color.svgshift.exe, 00000007.00000003.5558469508.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574766445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571012820.00004AB800A82000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557988010.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571943864.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558656758.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570829277.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5574178356.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5562504154.00004AB802604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571466154.00004AB80239A000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5557817327.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5571140407.00004AB802332000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570686988.00004AB802316000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5572302653.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561965445.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5558160028.00004AB800AC2000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5561411792.00004AB801604000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5554616194.00004AB801804000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5560097657.00004AB801404000.00000004.00001000.00020000.00000000.sdmp, shift.exe, 00000007.00000003.5570515748.00004AB800AFA000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		unknown

                                                                                                                                                                                                          World Map of Contacted IPs

                                                                                                                                                                                                          • No. of IPs < 25%
                                                                                                                                                                                                          • 25% < No. of IPs < 50%
                                                                                                                                                                                                          • 50% < No. of IPs < 75%
                                                                                                                                                                                                          • 75% < No. of IPs

                                                                                                                                                                                                          Public IPs

                                                                                                                                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                          35.186.241.51
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.250.65.163
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          172.67.214.207
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                          216.239.34.181
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.251.40.110
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.251.32.106
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          104.22.1.81
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                          142.250.31.95
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.251.111.154
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          1.1.1.1
                                                                                                                                                                                                          		unknownAustralia
                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                          142.250.72.106
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          3.140.172.47
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                          108.138.106.101
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                          20.42.65.92
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                                                                          18.173.132.52
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse
                                                                                                                                                                                                          142.250.64.106
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          65.108.134.244
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		11022ALABANZA-BALTUSfalse
                                                                                                                                                                                                          3.131.25.94
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		16509AMAZON-02USfalse
                                                                                                                                                                                                          142.250.81.226
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.250.80.10
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.250.80.34
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          239.255.255.250
                                                                                                                                                                                                          		unknownReserved
                                                                                                                                                                                                          		unknownunknownfalse
                                                                                                                                                                                                          34.120.195.249
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          142.251.41.3
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          172.67.149.20
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                          104.22.76.241
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                          142.250.65.168
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		15169GOOGLEUSfalse
                                                                                                                                                                                                          18.164.96.46
                                                                                                                                                                                                          		unknownUnited States
                                                                                                                                                                                                          		3MIT-GATEWAYSUSfalse

                                                                                                                                                                                                          General Information

                                                                                                                                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                          Analysis ID:1541415
                                                                                                                                                                                                          Start date and time:2024-10-24 20:24:50 +02:00
                                                                                                                                                                                                          Joe Sandbox product:CloudBasic
                                                                                                                                                                                                          Overall analysis duration:0h 14m 21s
                                                                                                                                                                                                          Hypervisor based Inspection enabled:false
                                                                                                                                                                                                          Report type:full
                                                                                                                                                                                                          Cookbook file name:default.jbs
                                                                                                                                                                                                          Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                                                                                                                                                                          Run name:Run with higher sleep bypass
                                                                                                                                                                                                          Number of analysed new started processes analysed:40
                                                                                                                                                                                                          Number of new started drivers analysed:0
                                                                                                                                                                                                          Number of existing processes analysed:0
                                                                                                                                                                                                          Number of existing drivers analysed:0
                                                                                                                                                                                                          Number of injected processes analysed:1
                                                                                                                                                                                                          Technologies:
                                                                                                                                                                                                          • HCA enabled
                                                                                                                                                                                                          • EGA enabled
                                                                                                                                                                                                          • AMSI enabled
                                                                                                                                                                                                          Analysis Mode:default
                                                                                                                                                                                                          Analysis stop reason:Timeout
                                                                                                                                                                                                          Sample name:Shift Setup.exe
                                                                                                                                                                                                          Detection:SUS
                                                                                                                                                                                                          Classification:sus26.spyw.evad.winEXE@54/762@0/28
                                                                                                                                                                                                          EGA Information:Failed
                                                                                                                                                                                                          HCA Information:Failed
                                                                                                                                                                                                          Cookbook Comments:
                                                                                                                                                                                                          • Found application associated with file extension: .exe
                                                                                                                                                                                                          • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                                                                                                                                                                                          Warnings

                                                                                                                                                                                                          • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, svchost.exe
                                                                                                                                                                                                          • Execution Graph export aborted for target shift.exe, PID 3436 because there are no executed function
                                                                                                                                                                                                          • Execution Graph export aborted for target shift.exe, PID 7164 because there are no executed function
                                                                                                                                                                                                          • Execution Graph export aborted for target shift.exe, PID 7984 because there are no executed function
                                                                                                                                                                                                          • Execution Graph export aborted for target shift.exe, PID 9204 because there are no executed function
                                                                                                                                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                          • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                                                                                                                          • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                          • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                                                                          • VT rate limit hit for: Shift Setup.exe

                                                                                                                                                                                                          Simulations

                                                                                                                                                                                                          Behavior and APIs

                                                                                                                                                                                                          TimeTypeDescription
                                                                                                                                                                                                          20:27:28Task SchedulerRun new task: ShiftLaunchTask path: "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" s>--start-maximized --launch-source=sign-in
                                                                                                                                                                                                          20:27:30AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ShiftAutoLaunch_53CF6764BCE293C804D7A1CE3A191AD0 "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
                                                                                                                                                                                                          20:27:38AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ShiftAutoLaunch_53CF6764BCE293C804D7A1CE3A191AD0 "C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in

                                                                                                                                                                                                          Joe Sandbox View / Context

                                                                                                                                                                                                          IPs

                                                                                                                                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                          1.1.1.1PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                                                                                                                                          • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                                                                                                                                          AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 1.1.1.1/
                                                                                                                                                                                                          INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                          • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                                                                                                                                          Go.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          • 1.1.1.1/
                                                                                                                                                                                                          172.67.214.207Shift - Recipes_spn7g.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            108.138.106.101You have a newly assigned document from Frey Navarro P.L.L.C. .msgGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                              https://solartechnology.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                https://www.eventcreate.com/e/rfp-reference-recommendatioGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  https://knowledgewebcasts.com/become-cle-cpe-speaker/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    https://url.uk.m.mimecastprotect.com/s/nHqyCj8BmuO69jcWWbASGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                      https://manual-restore.pages.dev/IP:Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        https://retik-finance.web.app/IP:Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                          https://vergoss.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            https://ossified-spandex-39f.notion.site/Salzberg-Insurance-Agency-1fe63f0e44914842b455cad5424ead91?pvs=4Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              https://ossified-spandex-39f.notion.site/Salzberg-Insurance-Agency-1fe63f0e44914842b455cad5424ead91?pvs=4Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                104.22.1.81OneLaunch - EarthView3D_3o3f1.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                  Domains

                                                                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                                                                  ASNs

                                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                  CLOUDFLARENETUShttp://lowes.mooo.com/index.php?search=4&d16852&morde=354-1256&lm=400100KWWT29761&sd=15&page=9u6rpKHD2TMFWFa#izRRKlsmoFgLg4jmhaU9Get hashmaliciousPhisherBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://chapelet-mariae.com.pl/qgxPm/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                                                                  https://tronlkam8s2.z13.web.core.windows.netGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  http://google.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  • 1.1.1.1
                                                                                                                                                                                                                                  http://tronlkam8s2.z13.web.core.windows.netGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                  • 104.21.53.8
                                                                                                                                                                                                                                  http://cint.securiguard.ccGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#Get hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                                                                  22390016593_20210618_14375054_HesapOzeti.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  CLOUDFLARENETUShttp://lowes.mooo.com/index.php?search=4&d16852&morde=354-1256&lm=400100KWWT29761&sd=15&page=9u6rpKHD2TMFWFa#izRRKlsmoFgLg4jmhaU9Get hashmaliciousPhisherBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://chapelet-mariae.com.pl/qgxPm/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                                                                  https://tronlkam8s2.z13.web.core.windows.netGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  http://google.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  • 1.1.1.1
                                                                                                                                                                                                                                  http://tronlkam8s2.z13.web.core.windows.netGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                  • 104.21.53.8
                                                                                                                                                                                                                                  http://cint.securiguard.ccGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#Get hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                                                                  22390016593_20210618_14375054_HesapOzeti.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  CLOUDFLARENETUShttp://lowes.mooo.com/index.php?search=4&d16852&morde=354-1256&lm=400100KWWT29761&sd=15&page=9u6rpKHD2TMFWFa#izRRKlsmoFgLg4jmhaU9Get hashmaliciousPhisherBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://chapelet-mariae.com.pl/qgxPm/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                                                                  https://tronlkam8s2.z13.web.core.windows.netGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  http://google.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                  • 1.1.1.1
                                                                                                                                                                                                                                  http://tronlkam8s2.z13.web.core.windows.netGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://na4.docusign.net/Signing/EmailStart.aspx?a=c1ee55e8-d253-4731-bf85-5377494446fc&etti=24&acct=c49653d8-ee55-4f22-afc9-287006261d0b&er=251e9446-3fcb-4714-8d01-feee559625a8Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                  • 104.21.53.8
                                                                                                                                                                                                                                  http://cint.securiguard.ccGet hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                                                                  • 188.114.96.3
                                                                                                                                                                                                                                  https://8jkfw9cqp7ep.z13.web.core.windows.net/?zpbid=78432_55610c1d-9229-11ef-824f-03718b6de7bb#Get hashmaliciousHTMLPhisher, TechSupportScamBrowse
                                                                                                                                                                                                                                  • 104.17.25.14
                                                                                                                                                                                                                                  22390016593_20210618_14375054_HesapOzeti.pdf.exeGet hashmaliciousSnake KeyloggerBrowse
                                                                                                                                                                                                                                  • 188.114.96.3

                                                                                                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                                                                  Dropped Files

                                                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\d3dcompiler_47.dllhttp://wavebrowser.coGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                    Shift - Recipes_spn7g.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      https://www.dropbox.com/scl/fi/2u0ns17aqf2nkkout3i4e/Wion-Setup.exe?rlkey=bczprnlv9lpsjsrcm2mwnqhrh&st=tkdq1g8n&dl=1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                        https://www.googleadservices.com/pagead/aclk?sa=L&ai=CEPSIY7k7Zpu1AY3rkPIP8q21mAvP_pi8d4PY85XiEsq6jPG-ARABIPT5xiVgyeaGi7ykoBqgAcCz_YIDyAEC4AIAqAMByAMIqgSdAk_QZfhjp8EKKRw8Ud-sac3T3jbhfjxjJ1sRhgU3SOjAuI5huqeTvemsIazylmO5A9WU45_edGutcUqL46MvuNtxU89a64S7xhljcSlyUs-dysnWLJ2j0jUpH_gKnco9owTuaX1dg-lH7IYSpQI3MKj-Dr00v1SC_8ZhuzoINVR1E2pcblzJpyD5_udwujRkOY3Fao0Lt8Mai9Sq-EbJfdXMijbwOeNV94FwcwlSMZ7he13IkHy_a1HexFAPvo5qqjQXKG7VuYCajYpF3q5URq0loIuDY5WXWNc5RPV77yzvPDM2ytOukuK76vBmfoFdcFIyWUc5xZIVsm9dr8SzjJNE1z63RwDOkXHpq4VxrPcl1gRfUlqaUGyYeMbOoMAEp9WvltcE4AQBiAWQgcDhTpAGAaAGAoAHqMyCfYgHAZAHAqgH2baxAqgH1ckbqAemvhuoB47OG6gHk9gbqAfulrECqAf-nrECqAevvrECqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB-C9sQKoB_-esQKoB9-fsQKoB_jCsQKoB_vCsQLYBwHSCCcIABACGB0yAQA6Dp_QgICAgASAwICAgKAoSL39wTpYjsuajM3-hQOxCUbAF_v0mAHVgAoDmAsByAsBqg0CVVPIDQHiDRMIlf2ajM3-hQMVjTVECB3yVg2z2BMM0BUB-BYBgBcBshgJEgLeaBgCIgEA6BgB&ae=1&gclid=Cj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcB&num=1&cid=CAQSQwB7FLtqgUEuOym-5Tn68arUiPJ1jdwPgw46Y6zUHfAkI3hTIEhGQzVeYafsm9LBj6pxutwTRiLFJPhCq9OvYdD7CqQYAQ&sig=AOD64_2G4fRbd2sH1E5jnf1iXQS4SW_Q2g&client=ca-pub-6396844742497208&rf=5&nx=CLICK_X&ny=CLICK_Y&uap=UACH(platform)&uapv=UACH(platformVersion)&uaa=UACH(architecture)&uam=UACH(model)&uafv=UACH(uaFullVersion)&uab=UACH(bitness)&uaw=UACH(wow64)&uafvl=UACH(fullVersionList)&nb=2&adurl=https://browsingwithwave.com/%3Fsrc%3Dd-aff16-cp21142438032%26ob%3Dobgcobedobem%26dvc%3Dc%26k%3D%26crt%3D695418066867%26adp%3D%26plc%3D%26tgt%3D%26sl%3D%26cpd%3D21142438032%26iid%3Dwav%26gclid%3DCj0KCQjwxeyxBhC7ARIsAC7dS38YLg3rX_OKomm_dfFxFHKQ-xaABBJ-7gCz8VhxHk9qVjyKpQQOlOIaAvqNEALw_wcBGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                          https://meet.servers.getgo.com/opener/e30.eyJpYXQiOjE3MTQ0OTcwOTYsImxhdW5jaFBhcmFtcyI6eyJidWlsZCI6IjE5OTUwIiwidGVsZW1ldHJ5VVJMIjoiaHR0cHM6Ly9sYXVuY2hzdGF0dXMuZ2V0Z28uY29tL2xhdW5jaGVyMi90ZWxlbWV0cnkvaGVscGVyP3Rva2VuPWcybS1yNGFnZXJmbmM4eGM1YnQwb2ZwY2poZC1iMTk5NTAtc2Nsc0pvaW5fYjBmZGI5NjFfNjM2OF80YTU2XzgwMTFfMmI0ZTlmYjEzNmRmIiwiZW5kcG9pbnRQYXJhbXMiOnsiUHJvZHVjdCI6ImcybSIsInNlc3Npb25UcmFja2luZ0lkIjoiY2xzSm9pbi1iMGZkYjk2MS02MzY4LTRhNTYtODAxMS0yYjRlOWZiMTM2ZGYiLCJsYXVuY2hVcmwiOiJtZWV0aW5nP3Nlc3Npb25UcmFja2luZ0lkPWNsc0pvaW4tYjBmZGI5NjEtNjM2OC00YTU2LTgwMTEtMmI0ZTlmYjEzNmRmJmNsaWVudEdlbmVyYXRpb249cm9sbGluZyIsImVudiI6ImxpdmUifX0sInZlcnNpb24iOiIxLjAiLCJmbG93VHlwZSI6ImpvaW4iLCJlbmRwb2ludEZsYXZvciI6eyJmbGF2b3IiOiJuZXV0cm9uIiwiZmxhdm9yRW5mb3JjZWQiOiJ0cnVlIn0sImlzRmxhdm9yRmluYWwiOnRydWV9.e30Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                            SecuriteInfo.com.Win32.MalwareX-gen.8794.16509.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              SecuriteInfo.com.Win32.MalwareX-gen.8794.16509.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                DeepLSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                  DeepLSetup.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                    https://www.delldisplaymanagerwindows.comGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Shift Setup.tmp_e1b2a0578964d5287cfe4fb45c911a66aeb1f8fb_f4a98051_e519c89e-e2d8-465d-8cbe-84e8107609b6\Report.wer

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                                                      Entropy (8bit):1.5224444578351297
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:+pKaJb5ihImJ8q6jLomixbP4xA2/RiymDu76ufAIO84:LClihRJ8q6juL4xFRitDu76ufAIO84
                                                                                                                                                                                                                                                      MD5:07EDC5C6A8408E24ADCEDD55EEB953EF
                                                                                                                                                                                                                                                      SHA1:198DCCBF5D4006ACBE03CC8098A82BDE458E96C4
                                                                                                                                                                                                                                                      SHA-256:2BEB153F6C405916702734C564EFAF11B5554C093ABAF436F25F09748A63228E
                                                                                                                                                                                                                                                      SHA-512:8A12D7526ADCE80B98865567D5409E6169B4C3CEB16205E5D101D745A915D06C7475C62F677C54D5B1DA610DE815BBE671C31FCDDCD84EE032B7A122239F398D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.6.8.0.8.2.5.6.3.3.1.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.6.8.0.8.3.0.5.2.7.1.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.5.1.9.c.8.9.e.-.e.2.d.8.-.4.6.5.d.-.8.c.b.e.-.8.4.e.8.1.0.7.6.0.9.b.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.3.c.8.e.2.5.-.9.8.b.3.-.4.4.0.5.-.8.6.8.c.-.3.c.e.c.1.1.b.4.e.9.d.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.h.i.f.t. .S.e.t.u.p...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.1.6.4.-.0.0.0.1.-.0.0.4.d.-.e.b.2.1.-.c.1.4.b.4.2.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.a.f.2.4.8.2.9.a.7.a.5.6.2.2.0.1.7.3.1.b.d.e.c.8.c.2.5.c.7.d.9.0.0.0.0.0.0.0.0.!.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Shift Setup.tmp_ec869baa3e4ecb3fdbdd6cc9534284fb2add4_f4a98051_fea3e95e-5f43-467f-a89b-fc6635c68e17\Report.wer

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                                                      Entropy (8bit):1.5219987956938505
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:Z0b5ih0mLP9jjLomixbP4xA2/RiymDu76ufAIO84:2lihdLP9jjuL4xFRitDu76ufAIO84
                                                                                                                                                                                                                                                      MD5:5592D4584FE5EAC081EC41DCEAA4619B
                                                                                                                                                                                                                                                      SHA1:093AFD85DD5EF966437A96771623E6B4334ECEF3
                                                                                                                                                                                                                                                      SHA-256:C527ED099001C64AD76C6FAEC78C243FE8671C8DFB0339B31E5E31A6E860E664
                                                                                                                                                                                                                                                      SHA-512:7EFC4186679CC663A8D82C916BD2F4C3EAAA5CAE2D3FF6A5895B04C90C06E17C58BBFF2E928C7B0194F3EC37CDA81E28A1B04287967F38060C038FF7E5EA959B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.2.6.8.0.4.9.8.9.2.9.3.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.2.6.8.0.5.0.5.8.6.9.0.5.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.e.a.3.e.9.5.e.-.5.f.4.3.-.4.6.7.f.-.a.8.9.b.-.f.c.6.6.3.5.c.6.8.e.1.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.e.a.a.9.2.f.2.-.c.d.1.4.-.4.a.a.b.-.a.4.e.e.-.4.d.9.6.6.6.1.d.c.6.9.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.h.i.f.t. .S.e.t.u.p...t.m.p.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.2.1.6.4.-.0.0.0.1.-.0.0.4.d.-.e.b.2.1.-.c.1.4.b.4.2.2.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.a.f.2.4.8.2.9.a.7.a.5.6.2.2.0.1.7.3.1.b.d.e.c.8.c.2.5.c.7.d.9.0.0.0.0.0.0.0.0.!.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C77.tmp.dmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Thu Oct 24 18:27:30 2024, 0x1205a4 type
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):273815
                                                                                                                                                                                                                                                      Entropy (8bit):3.582146271700384
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:A9i5gFSVX0iLTgO5YNWlnB6yxtT6fOAp1RVeNE/y/6310BojRTpN4uE2aOHpMEKV:AI+yRLTgOBPGfJLRWL/WPL4uEqHpqXF
                                                                                                                                                                                                                                                      MD5:82DDBD6CB4E20ABD71E7A3E9B15AA27E
                                                                                                                                                                                                                                                      SHA1:939F371481CD60E6889CB9299BA6AAFC2913AA2E
                                                                                                                                                                                                                                                      SHA-256:5D07395850F6DE85E1422C51EA1C6E60771975E2DD7972D77F6700349E933D1F
                                                                                                                                                                                                                                                      SHA-512:97148B35900276928BE6D57D5D9A9AD17A609B178F0E159AE605C9034F9D35EB5EE773B194CA2CA982483AB606C25C8332B3B3FDA051E8F6319B0A868F3B6A50
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MDMP..a..... ..........g........................`1..............H;......D....|..........`.......8...........T...........Pt..G...........\<..........H>..............................................................................bJ.......>......GenuineIntel...........T.......d!..k..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DEF.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8320
                                                                                                                                                                                                                                                      Entropy (8bit):3.692817643445562
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:R9l7lZNiGs6Mq6YFl69WRgmfZPe7prt89bB4KsfU7Om:R9lnNi16Mq6YX69WRgmfZVB4pfAX
                                                                                                                                                                                                                                                      MD5:6012B9F442A49596FE08281837AE322B
                                                                                                                                                                                                                                                      SHA1:347D9DBF66640F7E419D74CFF5A0F51324B0EE74
                                                                                                                                                                                                                                                      SHA-256:276D68E53DB7881DB8E2F0A00F953673A2B51DEB34237A1103D2EAAD83C35B3A
                                                                                                                                                                                                                                                      SHA-512:46CD5BB8C938714BBBD8EF9E8448A975DDD10058F08647AD737695A6A21EA094AE095BDDCD72AEAEB60927F407761FCD32E9575C8392117550DD0BD74FE7EE26
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.5.4.8.<./.P.i.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E2E.tmp.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4852
                                                                                                                                                                                                                                                      Entropy (8bit):4.460626539474925
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:cvIwwtl8zsPe702I7VFJ5WS2Cfjk0s3rm8M4JuhXDhiX/FtQ+q8t7XrgXFeC7dQk:uILfm7GySPfuJuhXliXEK7XrgX8cKJYd
                                                                                                                                                                                                                                                      MD5:84AFAC3F7C39F39F8F3DFE2BF783EE07
                                                                                                                                                                                                                                                      SHA1:AF07B65197276186DC8F087BF95D191BA5A64E5D
                                                                                                                                                                                                                                                      SHA-256:40CECBF450C17ED175E46F64BBBA7D271FD3667F081C4B39F562C5691738C00B
                                                                                                                                                                                                                                                      SHA-512:5C58309AD2C38CF818F3C5A173946335EDD87BD5B6145825265B2D5C4FD21FD4E29DE7CAC1967BB9FDC4EFD99EF1968047751F175A405F4FB976EB03A3829166
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222901659" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC17.tmp.dmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:Mini DuMP crash report, 15 streams, Thu Oct 24 18:28:02 2024, 0x1205a4 type
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):264489
                                                                                                                                                                                                                                                      Entropy (8bit):3.6299805480587506
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:ssZMISVXMJLTgOlYNWlnB6yxtT2fOAw1RVeNb/yR310BojRXPpN4uE2aOChIHKe:ss/y2LTgqBPSfJiRWOrPX/4uEqCq
                                                                                                                                                                                                                                                      MD5:5BA84E860205FC0B1E06EC78EEF7A97B
                                                                                                                                                                                                                                                      SHA1:DBD7D484DA59B2B8E6543CC3EABFFC3986BC9F49
                                                                                                                                                                                                                                                      SHA-256:F6F12F85726858C16C472CDDBC5A2592341634D630B7A4D4EC32B72797E29FF8
                                                                                                                                                                                                                                                      SHA-512:C52CA7F75587CAD6CCBE9F97B8AEE3EEAC68809115BD0B9447C3B569F1FEF30942AF1414F531FC272CE52C467A71083134F102A4CC48CA902896B4E2D6BBA545
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MDMP..a..... ..........g........................`1...............;......t....y..........`.......8...........T............q..............,<...........>..............................................................................bJ.......>......GenuineIntel...........T.......d!..k..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD12.tmp.WERInternalMetadata.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8320
                                                                                                                                                                                                                                                      Entropy (8bit):3.694017274905868
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:R9l7lZNiGO6626YF56wtDRgmftEte7pDr89bgKsft0gm:R9lnNi36626Yr6gDRgmftERgpftS
                                                                                                                                                                                                                                                      MD5:52FF6DB70A2D99D1CF31991A3F4236F6
                                                                                                                                                                                                                                                      SHA1:A9061458D7410875C2F7FBEC071B9AB09B828F02
                                                                                                                                                                                                                                                      SHA-256:9D18855BC7074D78E96501C5F00BFEF27E0C18C703ADCDFF16A62AD177753FD7
                                                                                                                                                                                                                                                      SHA-512:3FB241AF05CF6BBC8F3DD340A3FA11FFCDF1317CC336D3EEADA003E2298F4B8963458B1E84F2DCC58CA79F5F934A1E379E867927CBA654E9455CE22477A18E1E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.2.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...1.1.6.5...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.6.5.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.5.4.8.<./.P.i.

                                                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD42.tmp.xml

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4852
                                                                                                                                                                                                                                                      Entropy (8bit):4.465963271088645
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:cvIwwtl8zsPe702I7VFJ5WS2CfjkNs3rm8M4JuhXDhiXZFm5k+q8t7XrgX/eC7d3:uILfm7GySPfpJuhXliXxK7XrgXmcKJYd
                                                                                                                                                                                                                                                      MD5:B31B39CF52089CE8240E2A4649949759
                                                                                                                                                                                                                                                      SHA1:FC41AB744478CAEA776BDB654B848ED37C69E201
                                                                                                                                                                                                                                                      SHA-256:4A74A928F6E6D966C3A18435485D4C4689E5A6D94ADAC96AB0E0B5A2CC97B443
                                                                                                                                                                                                                                                      SHA-512:3E791071189A3405CE413191D97968B52F685A23465BDB89E6BC2C1EBA2BBDD298A4224B13A2E918E45CD32C3A042F94F6DA9890CE9CF3A9E58BB9052B17F8C7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19042" />.. <arg nm="vercsdbld" val="1165" />.. <arg nm="verqfe" val="1165" />.. <arg nm="csdbld" val="1165" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="242" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="222901659" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="

                                                                                                                                                                                                                                                      C:\Users\user\AppData\LocalLow\Intel\ShaderCache\1f662576c1307e8815cf486ce6420cd77d6fff72acb29f21729b15083b8d20f4

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):46256
                                                                                                                                                                                                                                                      Entropy (8bit):7.9282571970214235
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:768:5p4K+Cl4EfvG8h38sm+A//DEJrs52wDmWIt4+AbIalFY/yil2H7XHsc0zfC:L4Kj6v8d8rDErwDmALHPSyis8fC
                                                                                                                                                                                                                                                      MD5:9684C5FEB0798D2CF69C8B9C6F31C4AB
                                                                                                                                                                                                                                                      SHA1:C822F00D5ACA409790128C611480706B5ED60E18
                                                                                                                                                                                                                                                      SHA-256:20FC1B62AD576D27FFECDE0743D622CCD8E96A1468F0E0611D98C9952057B22B
                                                                                                                                                                                                                                                      SHA-512:944B775CFD69E97B0259EC38EEAF09CA5047690D9BE6D10FAD02ADF8BD39EAEBCCF920E6EECC2AAEED3A9F70D52608DD1C16DB93C2D18A16CB39233EA705185F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:INSC.>.....Mar222021151921.w.(qP.;..hA......e.......o.*.yt.;I.M......@................R...?..x..TMk.@.~3..g..... c.J..-m....^. .-.K..U=H.ZS..e..y.'......{k..<z.y'3.].n.^....<...k..j&f.;3.OK....i....A...4...A..h.,...A.ft.@.............GOJV...c].vF.mv..y.....]....q.g....^.s...~...7.~.}8..s.K..4.....(.......[.NQ..2....r.^x..u....yO..=.&.....8..C...*=.]z .Xwk`.{..~..A]......7-O.q...v!......8..!....g..<.......H.._...sq.e......M............,.JS......_.K..:...+...8...I.y....(.mu.e.>...#u.!X..%.nO..'4.R'k_......o......|..Q./u....z....q1.X...'.t.^L...g.u_..@....w.......O.\....S..a..xV.Cr..C...:..1.e.s....0R..._|.U..1....).f'.G....!};j].J,,.....Mqz.............................A<U.p.H{x..V.KTQ...=..pt|#.".7.P....`\8c.@.TRz..T+..+.......j)..r./..$Z..h.B...E.E..}.w..&5W..o.s.;..s...c;3cK..E......O..a..!.a0!.#.&T....U>......0.....4orO=........../....!$..j..i...ZS..p....4.4.d.w...g......*.^s...Z..Y....xk.,....c....g...4..'g...,.w....x@1A.{u^bQ.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\LocalLow\Intel\ShaderCache\642fb199dd1e1e85061c19fe5d4be9f5c4a28e39eb96025ec138de89a0e89146

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2308
                                                                                                                                                                                                                                                      Entropy (8bit):7.443880482170647
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:Bg8aOfhBhL6Kq6mU+qwJxVN93t6aaI/jwILFeOneigqyIC:1a6L6KqPqwJjN93A7QwIkFis
                                                                                                                                                                                                                                                      MD5:FF340CAEF3C66343A6A5517D2016B618
                                                                                                                                                                                                                                                      SHA1:334FB30ACDFB96DA8633F8EB7F709EE410D9CE99
                                                                                                                                                                                                                                                      SHA-256:240F62A3F3FC98DE29AAB686131DDCE2B662A3C0C5D72A08BA5793F3B3B6576E
                                                                                                                                                                                                                                                      SHA-512:52C35659487C9722D2F6011D9F5350241C395BC3CEF839712E510C9F4815D40A6A504D7020A4924C466964A29CE4D918A249EF21B8CB5EB3E909C08B47976399
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:INSC.>.....Mar222021151921"......!..;T.0.g..`5..S...m....+....+7...........................Px.c`@....%?gb`.".F(..G.h....08.........K@.........f.P....hf.....V..A.Az@.@..@..2$0hp..[..............l...L/..(..c`.X.......W.......]."......(...W.G.w...g............ t.7.1C..@....P#;...X..."_...k. t. D}.;..~..w..&.}$S..u*TR0U..Nf.......[u>......w...i..hs....(cI.....................&..$....x..S.J.@..IL.j..+....}.d..w...*.....u.n......~B.@?!;.....`.......3.2.......]..l.'|..L.X.`.fQ....&.......-0.....o.....o...K_.....R.}..A7....3i..@E:G..3...R.J.q3o.....7.7.....`..Ww..].H...X...cJ.......`_nB. ......<.....I.OG...'CO.F?....y^.qoE~$z....?.f...c..6.t..;2..i.....f<H.....g..?.........`V.uZA..%...m.!Xi..H....'1z...i..K:..v._x..G.Z..._,CM..Q..K ..[b....gV./^>..[.......r.A?4m........D................Z...I...x.c`@..'.%?gb`.".F(FU1........~...w.Pb..@y..A......&..Y@.D.V... ..gF.x.......4...A....B.s@h.V.]...y.!4....7....R.]\\.-...pE2.#......./...-..........U..Q4#.....=F....]...!..P

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\D3DSCache\435c56cf0b7f26eb\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.idx

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65552
                                                                                                                                                                                                                                                      Entropy (8bit):0.020027447254648455
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:5fllGlll/l/lXp9ZjXslAyUg0PBYGGJDASdlflLl1/m7llkNKO1dll:5fl0NspUg0PBYGA5/0/k31l
                                                                                                                                                                                                                                                      MD5:2C80AFFF6EA01C26250BF8089E0A77E5
                                                                                                                                                                                                                                                      SHA1:B93FF47BE2E827FE9CFAEA17F6D38873E572D25B
                                                                                                                                                                                                                                                      SHA-256:655521D23261C1261A22A0FBB06B43F50CF7BE3C2CF679525FC9DA23AA259E82
                                                                                                                                                                                                                                                      SHA-512:3E6D641566F38FF5A889132CC72C592C7707AE34C3FED42FBFE8DCF8D3FB3617062B20E9A260135663012AC8D5C00C36EDF31C90D38EAE11A8AFA279AE92E21A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\D3DSCache\435c56cf0b7f26eb\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.lock

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4
                                                                                                                                                                                                                                                      Entropy (8bit):1.5
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:R:R
                                                                                                                                                                                                                                                      MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                                                      SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                                                      SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                                                      SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:EERF

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\D3DSCache\435c56cf0b7f26eb\6F75932F-7DFC-4FB0-B4B8-12DE1AC415DA_VEN_8086&DEV_3E98&SUBSYS_3E98&REV_2.val

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                                                      Entropy (8bit):0.07061376840572021
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12:lVQ1anZVE24iPtkJ7Rli/lBZXt83PD4Mz2hs:8wnZKY4RWBZXlV
                                                                                                                                                                                                                                                      MD5:D0078A9F966027331C17BAE7D5F5A1B4
                                                                                                                                                                                                                                                      SHA1:6B86F75EDC9AB5014DBF8DA77199375DB2D95595
                                                                                                                                                                                                                                                      SHA-256:1576452E3F18D4A85D534B0B576C5F9A1B9A20EB78F234E4B9D928E5DFC5BFB6
                                                                                                                                                                                                                                                      SHA-512:F2C5D6F32F55348C21E81277F76D5FB924DED8DD59F9488F9C54A641AB88409B6656B9FD216566777D1F6CCA29DF1CF899D7EA7CC4E2DB46EB23F6D94E3F0D85
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:................n...(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.................................(...p.DJ!.IL.....Z.:B-.%...................>..I....>..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\D3DSCache\435c56cf0b7f26eb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65552
                                                                                                                                                                                                                                                      Entropy (8bit):0.012546043194964345
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:wlln/lGlll/l/lXp9ZjrPBY0HlKlltlU/DP:w/0dPBY0k/C
                                                                                                                                                                                                                                                      MD5:FE908D34BF8ADB1AF83A9AD30FCD6CBA
                                                                                                                                                                                                                                                      SHA1:F0F759D14D9C5A1BA5925ACA214CA58F5B364747
                                                                                                                                                                                                                                                      SHA-256:B3665A03FF91B0A880D00E15F91511D5ECF8B711BA4BB1E6F72FE7672D78E605
                                                                                                                                                                                                                                                      SHA-512:85F2A10D6C4FA3FE47634B627034FDCE5DF4640AE43874E96A26E36D048428CE8AB04C354E5E43E7EB448942A9A1B57426DB7CCB603911CF7324A329B59FF783
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:V@.7........................................f...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\D3DSCache\435c56cf0b7f26eb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4
                                                                                                                                                                                                                                                      Entropy (8bit):1.5
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:R:R
                                                                                                                                                                                                                                                      MD5:F49655F856ACB8884CC0ACE29216F511
                                                                                                                                                                                                                                                      SHA1:CB0F1F87EC0455EC349AAA950C600475AC7B7B6B
                                                                                                                                                                                                                                                      SHA-256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
                                                                                                                                                                                                                                                      SHA-512:599E93D25B174524495ED29653052B3590133096404873318F05FD68F4C9A5C9A3B30574551141FBB73D7329D6BE342699A17F3AE84554BAB784776DFDA2D5F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:EERF

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\D3DSCache\435c56cf0b7f26eb\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:Matlab v4 mat-file (little endian) (, numeric, rows 0, columns 16, imaginary
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):65536
                                                                                                                                                                                                                                                      Entropy (8bit):0.025851907138639853
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:9ll5l5d2DJqojreL1QNuVdhOEjlpQlyEXl2l6NGX3jlUMXlMpAdatt/llaia9sVu:M9q0TQXUEZ+lX12lhnjlH1MqAtb2Hrn
                                                                                                                                                                                                                                                      MD5:AD0B7227B3D31A4FD882F32B0FFD121F
                                                                                                                                                                                                                                                      SHA1:44A32C3733ED66246FAB84510CC68ECEAB714EFF
                                                                                                                                                                                                                                                      SHA-256:E1B7DB3F7A413295FA12466AD9B6B799F96EBE1250EBCA0F617ABA149E1A6B8B
                                                                                                                                                                                                                                                      SHA-512:70EB7CA0B98C7353E5AE55BA4C5147E15686F702087E13AA8EBCD4D60B124685D7F03646B42E88926E3642B38DF446E7F8A96B6B4900A9140308F31BECAB15A3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:................n...(....x:no.&A.e.u~+..C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.................................(...p.DJ!.IL.....Zm.F............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003f.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):103264
                                                                                                                                                                                                                                                      Entropy (8bit):4.022294560213379
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:IF2k84uyVviYiciooVKJHirGlnLM+9oemLbsF:nk84uyVviYiciooVKliuM+W5LwF
                                                                                                                                                                                                                                                      MD5:C746984BF149ECD20822A5CCB0791BB2
                                                                                                                                                                                                                                                      SHA1:53C8F5DF59902415ADCD4F94805F619A2DD01E97
                                                                                                                                                                                                                                                      SHA-256:C4E60E086D42A2F6647E6633FCE069FE5AF29E9860342850850ABE415ED921C9
                                                                                                                                                                                                                                                      SHA-512:74F02C15EF82F0873EDC0BB6308FF45938FBFC0E97F63F8C3D5F0AEBB4F1C50E35BC7C4DFA7685BDA9907A367A3D2369887233A715BF6C760D41B157D14DEA8D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....h... ...`...p.......P...........p...Q.......[..........h.......(...O.......e.n.-.U.S.;.e.n.-.G.B.............................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000040.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):106160
                                                                                                                                                                                                                                                      Entropy (8bit):4.02381600030552
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1536:tqeke+zTviYicioNLqUSifG9nei+w3lW041:fke+zTviYicioNLqri3i+S0r1
                                                                                                                                                                                                                                                      MD5:593E76CA8BCB8B3B09F559AE3D688E99
                                                                                                                                                                                                                                                      SHA1:8C3C22E39111A2BAF2C6E2ECC35618A81BB3F6EB
                                                                                                                                                                                                                                                      SHA-256:BE34CDACB117F12D5A1C5E4B486D0070A9F1D9B8C9BFA25CC7948446438C9E14
                                                                                                                                                                                                                                                      SHA-512:2BC989297C16B150D9F1EF6336E1087CB29528E024BE701FFA49EB9F9446ACC34229A986FE551436AC948B02E52ED671EF53FE5D26B2D88902620C3B11253CCC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....h... ...............P...............R......^...................h...P.......e.n.-.U.S.;.e.n.-.G.B...............0..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................A.r.t.h.u.r.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................(..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>...........................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\127.2.2.1372.manifest

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):223
                                                                                                                                                                                                                                                      Entropy (8bit):4.850408522166126
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6:KdhlRu9TbX+A8/5RFYp9uFk7FX0CdiYCXFiA1G:KLuVA5cp9u27V07vXF/G
                                                                                                                                                                                                                                                      MD5:F4029BE0FB80BCAFC1309AFD41F8DFBD
                                                                                                                                                                                                                                                      SHA1:B7C8F7F69015B8D2FBCFEAE642EDBFB6EC18CA50
                                                                                                                                                                                                                                                      SHA-256:4133642524CB9FADF8B4E09A713C4C2655DB7503A81F2EC71B1A91A68B79B329
                                                                                                                                                                                                                                                      SHA-512:BDF1445B30E6A27D31C0792CC0328E810E59B06B8AFB8C42DCE2CD120F0E12973D533601731CEC0F7CC42FEFF227B37F7F8E99929A42E76E153E9F66C36DD77F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='127.2.2.1372'.. version='127.2.2.1372'.. type='win32'/>.. <file name='shift_elf.dll'/>..</assembly>..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Extensions\external_extensions.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):99
                                                                                                                                                                                                                                                      Entropy (8bit):4.111010787987174
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3:RFLVuKFTlEMeXjKDnhz8dBAZwLZAsWRgOXLvV:jLVFFTllezC4dBAJRgOXLvV
                                                                                                                                                                                                                                                      MD5:280A9277B0E605E905D7F18B6148EEB7
                                                                                                                                                                                                                                                      SHA1:FCAF575897048F55B422A6DBEBA943B5D550A908
                                                                                                                                                                                                                                                      SHA-256:A68CAFD7D78D5C671C2560656653F2A4D83AB66D87A8728356A88FB1F477B3E6
                                                                                                                                                                                                                                                      SHA-512:F31635BC74F9A4B0CF07BE2AABAB4EC883A6B8E9AC3701B27EBAD6B0CA7A88C77699E69118DB0FF55B37F73FB759B8F4271E6A5DEFBE44AAB1F6981FB1179B07
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:// This json file will contain a list of extensions that will be included.// in the installer...{.}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\af.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):448987
                                                                                                                                                                                                                                                      Entropy (8bit):5.407472222912112
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:Yb5MepBN4ZG4mCT+2+H2JynBaE4I0+jozvew2b9+YIC29+2PsHzVdu516vr+YnUV:XepBN4ZT7T+2+H2JynBaE4I0+jozvew7
                                                                                                                                                                                                                                                      MD5:E8781DF0B878841CEEEBE26BECD0D5F9
                                                                                                                                                                                                                                                      SHA1:BA84112590D49A12549F8719087AEDC59A3E32DB
                                                                                                                                                                                                                                                      SHA-256:A52B4EBF01561ED67F87B5218E5169D5307578D81251CE9B0019D6ABED18F0AA
                                                                                                                                                                                                                                                      SHA-512:457C6D35007D2C10ACEC1EE2DC28279AF3B6D9F64B30853F3E4B29C65DF4A893D211CDAFCD15DF7709B63A8F3027B20C84329DD0EEF143456889B58B28A94E7E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........`"..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....|.....}...............................................................................'.....:...........%.....v.................G.....{.................g.................1.......................*.....s.......................S.....}.................G.....x.................].......................i.......................c.......................y.................L.......................i.......................).....l.......................$.....C.....L.................0.....?.................&.....6.............................R.............................c.......................|.................5.....y.......................W.....}.................9.....^.....k...........A.......................L.....j.....}...........-.....Y.....h...........%.....`.....|...........}.................a.................!.......................,.....x.......................I...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\am.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):701612
                                                                                                                                                                                                                                                      Entropy (8bit):5.088001599076139
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:DsDSGfQE8uAdxQyV/xZTsvknQvZze+C5a4N/YSXG/6CnePox30jH8+q:DelfQEqxQyV/xuvmQvZzvC5a4N/YSXG/
                                                                                                                                                                                                                                                      MD5:24C93C242F2F784C8A2A50A2F6DCB5F4
                                                                                                                                                                                                                                                      SHA1:2E8067BAE0B0E0E4A20C9AFD063245CE8C27E7C9
                                                                                                                                                                                                                                                      SHA-256:66B59C93E44EF207F8E66B025DD25FA9191318585A78F19DF9F20B864F9D2215
                                                                                                                                                                                                                                                      SHA-512:5B45CF2493F83F5A6D7949EB12BAED5AC290CECF378221B0459CEFE66B1FB2663638A06363425F80F0152B373E753B3C7A08C992A3E2D0013F9D76DEF44E25D0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........^"..e.....h.....i.....j.....k.....l.$...n.,...o.1...p.>...q.D...r.P...s.a...t.j...v.....w.....y.....z.....|.....}.........................................................................+.....Z.....y.....M.....,......................._...................................N.......................R...........D.....................................................i...........|.....*.................R.........../.....N...................................G.......................]...................................B.................T.....g...........C.....t...........A...........E.....q.................................../.................+............................. .....h.....x.....,...........T.....z...........m.................S.................*.........../.....u...........G.................w...........Y.................Q.................=...........s............................. .....:.......................R.................,.....R.................8.....K.......................4.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ar.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):768511
                                                                                                                                                                                                                                                      Entropy (8bit):5.076494741115427
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:DNK3F/BQuY/RJOab+0PedkkS5qNikmcj1v:DsyuWP5y
                                                                                                                                                                                                                                                      MD5:ECE1402596B5C8702C263603ECB74254
                                                                                                                                                                                                                                                      SHA1:67C964A1B56DFF2D8F8BA6C16A5ABDBEB3444654
                                                                                                                                                                                                                                                      SHA-256:E8FE13059DC6EF330797DBE8BE12F995DAD714D644C88751E9E66B1EB4B0AC01
                                                                                                                                                                                                                                                      SHA-512:010511A7C14409AF3965125D35F17661D45F26EA5E06FF87CEA25BF97BDDF67FB47CD3FC21276F46C8A4BE3A80909BAC750C7BFC63FB1BA56131D4F0A71E626B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........1"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.%...w.2...y.8...z.G...|.M...}._.....g.....l.....t.....|...........................................................?.....3.......................x...........o...........;...........`.....|.....2...........?.....p.............................^.............................T.......................O...................................D...........t......................._.........................................c.................L...........5.....h.....}...................................M.................[.................0...........j.................d...........(.....?...........J.................9...........;.....X...........W.................>.......................?.................H.................T...........,.....O.....l.........................................>.....W....._.....@...........!...........`.................w...........8.....O.................>.....R.......................;.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\bg.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):798398
                                                                                                                                                                                                                                                      Entropy (8bit):4.845034274979311
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:LLM7qi51LYazQkECmUJVbXkVKf3LAKTyVDoQj/umptjW2g59vpGQ33SlX2ID6yZq:LLsqi51LYnpUJVbXkVq3L3yVDoQjljWl
                                                                                                                                                                                                                                                      MD5:DF052F38946C65E5CDC00BFDAF3A1336
                                                                                                                                                                                                                                                      SHA1:436F877607A67DA30B11E07DC2EB9843FFB4EE9E
                                                                                                                                                                                                                                                      SHA-256:60BBF1F450575FD02220769B5C8389E0B4FAEA7FEB6113E838BDABED42E1C703
                                                                                                                                                                                                                                                      SHA-512:725CA62E6E9122660339C0F55AA9AA57AC4C8A39B2A2FD8143DFD8A78E288CF0A8B94835A7C477752030C3CD3D26C6E3D64552D670192DF46AAA22A524C24D2E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........f"..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}...................................................................(.....A.....^.................i...........1.......................?.....\.....L...........6.....,...........c...........N...........".....H...........c.......................x...........>.....:.............................w...........4.......................;.....'...........i.......................*.....r...................................8.................V...........&.....L.......................!...........J.................H.................,...........=.....}...........J...........&.....N.....I...../.......................:.................;.................C.................:.....e.....^.............................*.....k...........e...........`.................. ..... ..... .....!....."....4#....a#....Y$.....%.....%.....%.....&....@'.....'.....'....u(.....(....G)....q)....l*....@+.....+.....+

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\bn.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1005698
                                                                                                                                                                                                                                                      Entropy (8bit):4.466417848537653
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:k0HeFAjxopgGmpoS9GTHjaYPUuXFqvNvZNBby8eA5+Jek:LHeFAx5GmkLjaUUuXovNv/BbJ5u
                                                                                                                                                                                                                                                      MD5:30C97C28614ED9AA38D85A0685E04151
                                                                                                                                                                                                                                                      SHA1:5848A974EEEC85EED6F817EB720C2DA3F883D775
                                                                                                                                                                                                                                                      SHA-256:AEF37775D452B0C2DDE09D5E44A16A05EEE232ED50B9D9DDF76B98BC1FCE5B50
                                                                                                                                                                                                                                                      SHA-512:8717CEA1BBF73585C658742349CCE89EB6CBE2E58AFE1273732A120661203EEBEE55F54B753AD18DCECD9CAE2955EF978A2F2102E37FB7EC531BD1790D31E4CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........>"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.(...t.1...v.F...w.S...y.Y...z.h...|.n...}.....................................................................................:.....w.................d.................p...........I.....n.....h...........e.....].....<.......................f.......................f.............................p.............................y.....h.....8.......................j.............................|.......................p.................%.....k...........F.................:...........g.......................L.......................G.......................5.................T...........@.....c.......................,.....N.....j.....5.....}.....w.....F.......................-.....k...........i.....#........................ .....!.....!....L"....."....)#....^#....C$.....$....L%.....%.....&....5'.....'.....(....H).....*.....+.....+.....,.....-.........../...../.....0.....1....O1.....2.....2....V3.....3.....4...._5.....5

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ca.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):507877
                                                                                                                                                                                                                                                      Entropy (8bit):5.392319548966205
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:wCP1A9a7/vpscUr4wrjjVhI0lbQE8QSCJp2fExzsuwbAGU/dLHQ6BtBB6kJeIDo2:FPi9WCjlEEAMy+fG5/r9f6
                                                                                                                                                                                                                                                      MD5:CA9B0732738444FC89491BA32B26FB97
                                                                                                                                                                                                                                                      SHA1:69590AD2C8DC30AD8BA29B361D429AC17F21163D
                                                                                                                                                                                                                                                      SHA-256:6F0E01E96F1586A982BB34678707F8F7FABF678E32CF73652EADD9768792085B
                                                                                                                                                                                                                                                      SHA-512:A88B2ADC85961398A095782945C1D1E8DD6DE1D97D3A9C74DF88786E1F5BBC5BA7AE0507ACB78C831A246AF60F6BBB1E69927B5F4912FD3E906DADD6AC80FC7D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........Y"..e.....h.....i.....j.....k.....l.....n.....o.$...p.1...q.7...r.C...s.T...t.]...v.r...w.....y.....z.....|.....}...............................................................................<.....Z.........................................1.....J...........c.................K.......................T.......................I.......................i.................>...........0.....y.................q.................'.......................A.............................*.......................d.......................G.....m.....}...........,.....Y.....p...........:.....u.................@.....r.................&.....Q.....a.................'.....4.......................0...........".....i.................:.....i.................*.....M.................1.....F...........,.....t.................P.....s.................<.....h.....}...........A.................@...........:.....U...........A.................'.....~.......................j.......................}.................U.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\cs.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):509318
                                                                                                                                                                                                                                                      Entropy (8bit):5.828415288585642
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:7tHq6pqoTBgLf5NIXAUN5i0G/NcNMzSBRN6bA8QKs/:pK6pVKzzW5i0G/NcazSHN6a
                                                                                                                                                                                                                                                      MD5:D0D052F15076C61AEAC1C00ED8B25FDE
                                                                                                                                                                                                                                                      SHA1:EC3CF75A589CDA1C975827ACFA886EF355471106
                                                                                                                                                                                                                                                      SHA-256:406305EFB498C75F954240E38E737C25113247260E34F025D378DA0EC77B6A60
                                                                                                                                                                                                                                                      SHA-512:6FC4482627520A06F28A2F2429AD61ED48D3F47DE8536B8B29F9DE5D9B148D34D28301F67C4AE989FC304BC6DA88662CBBE10B33C12D5CAB527C79A885B04D35
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........J"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...|.|...}.................................................................................................>.........................................I...........!.....:.................[.....s...........5.....i.....|...........$.....L....._...........4.....i...................................|...........+.....C.................K.....[...........K.........................................U.....................................................b.......................e.......................u.......................f.......................h.........................................F................. .....o.......................1.......................7.......................=.................).....w.......................t.................&.................A.....Y...........G.................%...................................$.....9.......................(.................<.....S.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\da.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):472036
                                                                                                                                                                                                                                                      Entropy (8bit):5.444865855898398
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:BXWeS15/jWwzVWeSOBybK1sePOwD5+JwfwbXGHH25ncNkUZFXwazZhD:FWeKhqNq5uf5nuf
                                                                                                                                                                                                                                                      MD5:661FE3F331E79A232266280F484FC69F
                                                                                                                                                                                                                                                      SHA1:A418CC6FB0E86B1A2B29F10BA6BEB45D1881FF32
                                                                                                                                                                                                                                                      SHA-256:3AC87051A4313100BAE3F65E2D08DEE309D3BB6BC5B6ED137C8F880A4E878155
                                                                                                                                                                                                                                                      SHA-512:899265CD658BBAE5FE9047BD86221A32E5418F4255E42737D8040F08613CA904AB8340F561E95893E7AD5095F44647F9B17B9674397F6D6C4C82D971FEB0B336
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........f"..e.....h.....i.....j. ...k./...l.:...n.B...o.G...p.T...q.Z...r.f...s.w...t.....v.....w.....y.....z.....|.....}.........................................................................*.....>.....W...........<.....~.................p.................H.................9.................9.....M.................#.....0.................................................................V.....y...........S.......................w.................H.................6...........O.......................z.......................].......................6.....Z.....h................._.....r...........3.....c.....s...........'.....R....._.................,.....6.......................*...........%.....n.................;.....b.....z.................6.....N.......................".................D.....~...........3.....X.....q...........>.....n.................0.....n.................e.................M.................*.................&.....8.....}.......................d...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\de.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):505475
                                                                                                                                                                                                                                                      Entropy (8bit):5.482771361275814
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:xHN8NyJKMbiLTg9gXa9jMk9lFEwIA8Vz5GHZ6McMPdITCp:xSN+gvMgXaloz5TM7mTCp
                                                                                                                                                                                                                                                      MD5:2DEAE87ED16F76EA50C0066C1AA20E84
                                                                                                                                                                                                                                                      SHA1:3C8FA0613F3B5C6FB9EA91D7D71E0FDE79131B5D
                                                                                                                                                                                                                                                      SHA-256:232BBDAEC098E644C847AF011BDB7B09DD7BFA2E1B36F8B0BB073676A2CB79AA
                                                                                                                                                                                                                                                      SHA-512:7A41F5E41B58454969491291C8BF7A36F5D680EA94AC10413795DAEDB72E8BDED353B50F0686FBDDA53EC730F521ABA75929FBED8E17A1489FED946D63F99A21
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!U.e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................#.....$.....&.....7.....J.....\.....r.....,...........D.....Y...........\.................9...................................9.....Q...........<.....j.....{...........e.................4.............................!.....]...................................I.............................I.................W...........K.....j...........I.....k.................X.......................j.................+...................................1.....A...........(.....[.....l...........Q.........................................d...........Q.....g...........D.....f.....}...........0.....M.....`...........3.....\.....o.............................Y.......................k...................................R.....h...........v.................c...........#.....P...........9.....f.....{...........O.....x...............................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\el.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):868474
                                                                                                                                                                                                                                                      Entropy (8bit):4.923940014163886
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:fIAaS6yJeC0m+267FJjAmgDVoyiRNQClCt2rDQu3fjmf2WtKMalkoYv8AgmGn5Vt:fvaS6yJeCS267FJjAmgDVoyiRNQClCtG
                                                                                                                                                                                                                                                      MD5:7E0297BF24227AED6DE8AF03F8ABB79C
                                                                                                                                                                                                                                                      SHA1:A282C3159BA5AD85BFF49EB1DB5BA2D429C760E0
                                                                                                                                                                                                                                                      SHA-256:86E927BD0AC956D4B108267741295509B0135B9CBD58071A494AB8FABEF93AD1
                                                                                                                                                                                                                                                      SHA-512:511DCB900918772412D0CE076E829D67FA1BF4A84BECDE947D0BFB4227B3305C9B925E26FD6EE503E54E1B90348051A259E99F42224BD9581D95D069E25FCE57
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........Y"..e.....h.....i.....j.....k.....l.....n.....o."...p./...q.5...r.A...s.R...t.[...v.p...w.}...y.....z.....|.....}.........................................................................3.....m.......................o.................q...........4.....<...................................&.....p.....#.................*...........^.......................`...............................................T...................................2.....#...........g.......................s...........^...........[...........2...........(.....M.........................................=.....h.....1..........._...........Y...../.................y.....9.................m.....1.............................W...........\.....$.................].................8.........................................9...........6 ..... .....!....C!.....".....".....#....`#....K$.....$.....%.....%.....&.....'.....(.....(.....).....*....D+.....+.....,.....-..........H....../...../....70....Y0....`1....Z2.....2.....3

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\en-GB.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):412319
                                                                                                                                                                                                                                                      Entropy (8bit):5.4980098189170565
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:tb2RefhpEdmYs9hs81Mf9eM/2efaYJUZlTy5wERp03:VEdH61Mh/2HK503
                                                                                                                                                                                                                                                      MD5:8A2E65DD22E1DECA025F56A498CB33A6
                                                                                                                                                                                                                                                      SHA1:9C41A618675B8B9B65BDED98FFDCFDD07DBE573B
                                                                                                                                                                                                                                                      SHA-256:A1B5BE1200FCF325F5D39DC34D34B1FDA02C8544CDDA89A2ADDEBDC411B3BBB6
                                                                                                                                                                                                                                                      SHA-512:836B69D120AD12C60554A350D96D0348AC678D6F3EA6CFCF997329FB9AD5D830ED97B5DAF6D177B2B5168786AAF4B9789A48B8BA71421B3628253D28526803F3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...|.8...}.J.....R.....W....._.....g.....o.....v.....}...............................................8.......................O.......................E.......................I.......................%.....k......................./.....V.....c.......................5.................!.....9.............................i.......................7.......................!.............................K.....f.....u.............................Y.............................k.......................G.....t.......................7.....B.............................J.......................#.....|.......................[.....~.......................:.....O.............................k.......................R.............................\.......................@.....x.................c.................".....y.................'.....o.......................3.....U.....e.................>.....S.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\en-US.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):415343
                                                                                                                                                                                                                                                      Entropy (8bit):5.49659375934355
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:YOSZOqRfpvQ5lYBYNHQ8Mf9eLaU6faYqGPn+u5iUj/BolwR:YOSppvQ5CyLMKaUcL5glwR
                                                                                                                                                                                                                                                      MD5:13527C39F69FEE33F9E48858BB8EF69E
                                                                                                                                                                                                                                                      SHA1:322DDE463AECA60E03CC9C7EE0C24C4BA2CB377E
                                                                                                                                                                                                                                                      SHA-256:BBC958A9A9CEFEA01AB25E815D5778D810EEC9F751D6943049DB654BF933188E
                                                                                                                                                                                                                                                      SHA-512:E6FCD3DFA43946C4E5FF1A2815FF701DFDCC10FAA9D43BB95F6B6A00F1A54600BED3C42FD12B9C10BC2AAF3AE56C20246D6DB614F0FCAE7ECDA30BEA5E1A00D0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."m.e.....h.....i.....j.....k.....l.....n.#...o.(...p.5...q.;...r.G...s.X...t.a...v.v...w.....y.....z.....|.....}.....................................................................................-.................M.....a.................5.....E.................@.....V.................).....>.............................O.............................X.....}.................G.....|.................5.....f.....t.................6.....F.............................|.................0.....o.............................I.....h.....r.............................x.......................Y.......................$.....i.......................).....Q.....\...............................................,.....z.......................<.....x.......................>.....`.....o.................H.....n.............................m.......................R.......................N.......................s.......................t.......................>.....|.......................V.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\es-419.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):496236
                                                                                                                                                                                                                                                      Entropy (8bit):5.365255502162887
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:DjG1+SY1p302FeDDvpBYCC9oM15NUNy1CmNEq:Dj4+x0qC7phCz5NUWJ
                                                                                                                                                                                                                                                      MD5:9166A63DF2708176DD190E54DF9B0F4F
                                                                                                                                                                                                                                                      SHA1:BF408FDAAF1C5109C909021AADAF0012692C7962
                                                                                                                                                                                                                                                      SHA-256:E661A15D39644FF530F1FCCAFAA1E8EF46427EAAAC02085FD798DD7BE4800446
                                                                                                                                                                                                                                                      SHA-512:CBAE0BAA143D073A9EFF10AB0DAB805E7A73BF3F4367D18AF8BE5271ED9CBF1E5E74A74AAB730C5427616C0B3A2918F2B501024EAFF26DB7313F42CB4124612A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........`"..e.....h.....i.....j.....k.....l.&...n.....o.3...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....|.....}.....................................................................................E...........v.................i.................-...........=.................4.......................X.......................F.......................j.................L...........B.................$.......................W...................................F.....a...........x.................J......................./.......................&.......................@.......................e.......................f.......................L.......................D.......................|...........:.....[.................D.....d.................>.................>.....N...........C.................3.......................).......................M...................................x..........."...................................9.....M.........................................W.....w.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\es.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):495334
                                                                                                                                                                                                                                                      Entropy (8bit):5.355139485350427
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:siwmnswI++D12N6aqBgGcgpvpE+8vl8C/YnjE5W1LVwh6PZGk8mdg:Bnp3+4vsg0pal8XnjE5eLJ+
                                                                                                                                                                                                                                                      MD5:F980467C01266EB7EA6246AAC8733A46
                                                                                                                                                                                                                                                      SHA1:7F21181BDAF4FFC5DB5D14481EF8541A1AAE34BC
                                                                                                                                                                                                                                                      SHA-256:4EBED1EC4163B6FAA640CC2BE980D5D18AB9BCAD9BC7D3FDCD805B01C2947BAB
                                                                                                                                                                                                                                                      SHA-512:4E55BC87098276780ACA51AB248514BB4DF4B176DE5EFE954461277EDCBF621EF0A2490116D82C7E80AE3FC48027D677B73F8ADBDA6EEA4DC75FB534A2F3087C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........f"..e.....h.....i.....j.....k.&...l.1...n.9...o.>...p.K...q.Q...r.]...s.n...t.w...v.....w.....y.....z.....|.....}.........................................................................&.....;.....S.............................s.................D...........f.................Q.......................p.......................n...................................L.....y...........s.................?.......................i...................................Z.....s.............................T.......................H.......................:.......................U.......................O.......................?.......................&.....}.......................t.................,.......................d......................._.......................r...................................U.................=.....a.....y...........;.....i.....|...........K.................A...........%.....<...........I.................;.......................K.......................@...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\et.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):454435
                                                                                                                                                                                                                                                      Entropy (8bit):5.466016348967657
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:lwsulSe7HpiAuOnBNER+3UBF40gmFo+0pdrni5ZW25I4daG9xPQ3L:lwsLypH7BazumFo/25IL
                                                                                                                                                                                                                                                      MD5:8D80F3A5AD76D1FAE126F13360A26A05
                                                                                                                                                                                                                                                      SHA1:29A777752407C5B2B81DC11A3458EBEA23B213C4
                                                                                                                                                                                                                                                      SHA-256:B6444CA19BC52FD820E47E0A08B8805008C61A5CDA10C95D2AFE65317BCF4761
                                                                                                                                                                                                                                                      SHA-512:F488D1318A7A809DFC939F091A27ED394B2F45C02F1C1F1BDF5A823B93AAF932D4E542B08A333F22D776B8439228D650BF767D5DD47B50B6536F148872022462
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........d"..e.....h.....i.....j.....k.+...l.6...n.>...o.C...p.P...q.V...r.b...s.s...t.|...v.....w.....y.....z.....|.....}.........................................................................*.....?.....U...........j.................=.......................].................#.....................................................r.......................t...................................2.....H.................C.....V.................J.....^...........*.....`.....x...........m.................(.............................t.......................X.......................`.......................l.......................m.......................f.......................g.........................................1.......................".............................s.........................................,.............................r.......................~.................M.................2...........;...............................................d.......................b.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\fa.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):706195
                                                                                                                                                                                                                                                      Entropy (8bit):5.220597198068864
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:VYZj4Hb8u313uyqoT+sZXVXJc71a3VkrWhlnQCsNXMy1zkrBpPbeAfMCWJV/wTBv:mZjQ8u313uyqoT+sTJs1a3VkrWhlnQC3
                                                                                                                                                                                                                                                      MD5:43D59F40CF2DBE75216810D986D83BA8
                                                                                                                                                                                                                                                      SHA1:DFD1040F5AF810D0E88C628C1D74E3D31632B0FA
                                                                                                                                                                                                                                                      SHA-256:71FC06F9F14AADD5283B828A5B7938A3916DE36F07A9AFD6B8583745EE5F6EAA
                                                                                                                                                                                                                                                      SHA-512:A581A47D5491EC5F1A232D37CF2B27ABC28D65556858B0410450EE0288F0C8A7CBE053EBDBF958BE262D24863EA80688BB22648179863BFDA123362E8116F09E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."4.e.Z...h._...i.j...j.v...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.%.....-.....2.....:.....B.....J.....Q.....X....._.....a.....f...............................................'...............................................9.......................5.............................q...........W.....x.......................&...................................0.....y...........2........... .....>.......................?.................^...................................`...........$.....5...........U.................E...........5.....J...........t.................R.................+...........G.................4.................'...........}.............................2.....U...................................C.................r...........c...........(.............................@.................Z...........8.....Y.....W.....O...............................................m.................g.................0...........{.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\fi.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):459370
                                                                                                                                                                                                                                                      Entropy (8bit):5.441245496984023
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:ZAT2bPpvwilM19PX+SJ1oSplCIRZCsDp63OE2CLB5dvMUH0FBgVlPGMWgAAy/XHD:ZAyFvx619GCFq5dvMUUFBQJi
                                                                                                                                                                                                                                                      MD5:5C3783AF4FF6B15B60D86076C3D3BB5D
                                                                                                                                                                                                                                                      SHA1:39E1C092BE7E48D51C5FE93A4DE1DB66E6DE555E
                                                                                                                                                                                                                                                      SHA-256:1090CBCAB206931DD29105670A3918CBBBA52E6F554BA6A7A96C0C08B420782C
                                                                                                                                                                                                                                                      SHA-512:75B361FD37BA5B5865AD7FC348530589BF121EE8B43463E9B06F4D47263E4A5BF495D46D33855240451576477DE911D920A9D9034148A75E729E151A9F8145B8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........'"!.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.$...y.*...z.9...|.?...}.Q.....Y.....^.....f.....n.....v.....}.....................................................f...........9.....J.................C.....V...........3.....m.................W.......................L.....y.......................=.....M.......................9.................^.....x...........*.....V.....l...........,.....[.....p...........-.....^.....|...........f.......................q.......................D.....g.....u.................A.....M.......................$.....|.......................a.......................=.......................!.....s.........................................3.....x.......................X.....z.................V.....z.................U.......................>.....U.....d.................E.....W.................L.....f...........i.................:.......................J.......................%.....g.......................D.....o.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\fil.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513633
                                                                                                                                                                                                                                                      Entropy (8bit):5.228142279826954
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:gkd5Rb1KfbCY0nk2DQJMSdNahVzR5lxKoYNAXQTc:gE5R5KfHIQO5L
                                                                                                                                                                                                                                                      MD5:D44749B1800FB2CB52240F0D485A630C
                                                                                                                                                                                                                                                      SHA1:3105D4985214AE9811D5211DF4FF3780F820A164
                                                                                                                                                                                                                                                      SHA-256:D04ED6AD1366B2574DF71E339AE84AB043AE3E563A628875AF9A10663DF51E4B
                                                                                                                                                                                                                                                      SHA-512:8250AA6B6E65F3CBC24DEEA5295B7718BE0696C94E495D3EE7A08F17DA94E26466D4B54ED08AAE917604B27D2F02678535A1F69EA3C4F047254BE9C22BE2F99F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.#...s.4...t.=...v.R...w._...y.e...z.t...|.z...}..................................................................................... ...........V.................N.................%...........Z.................[.................0.................%.....4.................>.....Q...........Q.................Q...........".....I...........;.........................................W.................4...........[.................:.......................2.............................x.........................................@.......................L.......................N.......................O.......................s...........F.....c...........).....U.....s.................1.....G.................>.....X...........M.................3.......................L...................................D.....g...................................).....y...................................3.......................H................. .

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\fr.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):531202
                                                                                                                                                                                                                                                      Entropy (8bit):5.386272224990848
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:joirtGZLcm/VpV+x9ilZo7MYnYfk2Wb19B8Rx4SSWmS0nnwyBGUs1ll5pklKLZf5:jnBHmzVyq5Hv
                                                                                                                                                                                                                                                      MD5:0C3277F2A561A7B488BF32CFFA8AF24C
                                                                                                                                                                                                                                                      SHA1:15B7E8A10EB3EA0F5B4C0907F64D1E0AC3FAAEEC
                                                                                                                                                                                                                                                      SHA-256:316F8E45283B20D2E5C0D1EEFC69531AFF08303D1ECE788AF1D71010256F8E7E
                                                                                                                                                                                                                                                      SHA-512:72FB3675B5B50B64C303AAC600BF8A29517F6BB429603A08D9CA399D0CD69B257885275FE422D291B28093FBA1CD036E34BC5AD39D5E7B703BD6FB334B9A968B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........E"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.$...s.5...t.>...v.S...w.`...y.f...z.u...|.{...}.................................................................................................Q.................K.............................6.........................................V.......................[...................................M.....{...........f.................8.......................c.................$.................Q.....j.............................l.......................m.......................g.........................................5.................2.....G.................%.....3.......................!.......................+...................................m.......................Q.....q.................X.................I.................?.........................................B.....^...........J.................9...................................T.....{.............................G.......................Z.................,.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\gu.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):993518
                                                                                                                                                                                                                                                      Entropy (8bit):4.501679203415277
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:/dp8Dx89am2UJQxbtNRsmEIvRt1JIwjAwREJKVMjNiT7llj63rhMx70dai5j/wJV:/C5AotImRMlIUPya/25u1+r3
                                                                                                                                                                                                                                                      MD5:6603533457CD3DC6391D4CAF52B1C652
                                                                                                                                                                                                                                                      SHA1:D69FDDCBAB4B02BA70C32A46B11BEF2C74E567DA
                                                                                                                                                                                                                                                      SHA-256:28AD7F91DCDCC93D9B82E9C73E7D2B801F3E97729E651967F6A2A312932B94A6
                                                                                                                                                                                                                                                      SHA-512:A28D4E8E11FB9AF07D71D6E428448980C1775B006A87E29616EF374EE9BD267FAFE2EB415EF28ABAE7B214C9B1FF0F7F268422705019E50E95F1C2F6471B7DAC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........M"..e.....h.....i.....j.....k.....l.....n.....o.....p.+...q.1...r.=...s.N...t.W...v.l...w.y...y.....z.....|.....}.........................................................................-.....X...............................................I.......................@...........\.......................j...........8.....d......................."................. .....i.....w.....h...........>.................]...........c.....;.............................q.......................w...........A.................=...................................b.......................C.......................L.................z.....#.....y...........7...........>.....Z.......................:.....M.....V...........8.......................!...........&.....R.....q.....'...............................................? ..... ...."!....T!....7"....."....f#.....#.....$....J%.....%.....&....3'...._(.....)....O)....e*....O+.....+....6,...."-.....-....]...........^/.....0....w0.....0.....1.....2....D3....z3

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\he.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):630445
                                                                                                                                                                                                                                                      Entropy (8bit):4.8170432934008
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:EXsjXXN/hGNmpTdrbtQFmEnLsq9XjyeQCajd5m6vo8VFBSjmbjhyscDn1pzIZ:EcjXam75j
                                                                                                                                                                                                                                                      MD5:129ECB6F6D236547579B0666104EC9AF
                                                                                                                                                                                                                                                      SHA1:A88ABE01AAACBBB7862D6413F3EE40D26D8B881F
                                                                                                                                                                                                                                                      SHA-256:6748065961237A06449EF48B91C5BB1B4770A7BA7DD1A5117269980908B905FC
                                                                                                                                                                                                                                                      SHA-512:3FE7D894AD7E311EC54E697293B887321474D93616D940418537A9DCBA4CE25AFBE8BA64C151D2B41A2E25E0DDC7322B0754402A047CA1CDBE7E26E9F6D918C5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........@"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.+...t.4...v.I...w.V...y.\...z.k...|.q...}.....................................................................................&.......................@...........>.................U...........H.....h...........p.................f...........%.....6.................H.....j...........e.................l...........:.....^...........~.................z...........3.....J...........O.................r.......................(.......................c.............................2.........................................d.................-.................N....._...........G.........................................r...........J.....i...........Q.......................w.................T.................,...........?.................4.......................H...................................Z...........R.......................N.................F...........v.................m.................)...........l.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\hi.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1047989
                                                                                                                                                                                                                                                      Entropy (8bit):4.474936501546238
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:Mc9UztI/IzBdRefypsoV/BB0ZV1d1l+zgiln3G1Yym4Gs3D+FwGR3/cAtJNS1RPs:D90qgzBbFIcGjvm5tido
                                                                                                                                                                                                                                                      MD5:6B3B51A281DE5984FEEE230192087744
                                                                                                                                                                                                                                                      SHA1:CD3D077674A651E6ABF222D4C1970D8660ACE7F8
                                                                                                                                                                                                                                                      SHA-256:540E16005415B33C0DEA0BAB8AD1B78EC8B30669909DD4474EC1018D2BEC098E
                                                                                                                                                                                                                                                      SHA-512:43AD0EEB8842F3A56CD54D3890648AEAEA2233B7874461CC69196E801E66B7F900D5942908EAA56B18448A654559AAF92A8CD9DCCA40939E57228611743D211D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."/.e.d...h.i...i.z...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.#...}.5.....=.....B.....J.....R.....Z.....a.....h.....o.....p.....r.............................V.....j.....0.....n.....j.....N.................A.....v.....P.................h...........&.......................7...........{...................................4.....Y.....=...................................(.................=.....l.....w.....\...........'.....q.....n.....$.....g.....8...........>.....h....."...........&.....Q...................................l.......................{.......................S.................e...........c.....|.....;...........M.....l.....y.....j...........-...................................).....\...........A...........c...........}.....2............ ..... ....R!.....!.....!.....".....#....,$....^$....a%.....&.....&.....&....I(.....)....k*.....*.....+....z,.....,....>-....y.....[/...../....E0....91.....1....d2.....2.....3....t4.....4....45

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\hr.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):495049
                                                                                                                                                                                                                                                      Entropy (8bit):5.524179268024995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:aBY8TXfkSC0wWaBV08LErCxYbTPrrdOSAqGKtYpYQ0uPh01HvbX4hqQheEO4US+9:sY8bMSCTjxxk7doqx5IfEnKY
                                                                                                                                                                                                                                                      MD5:CB9200F266825B66BCC9752AF2EDC95E
                                                                                                                                                                                                                                                      SHA1:4E2A7D8CC295343916E7873E097CDE3239E03E81
                                                                                                                                                                                                                                                      SHA-256:A62F01C6CA7A40CAF4399F5382ED753477AB9464F05C2273D5692B901EF76F4C
                                                                                                                                                                                                                                                      SHA-512:1A5A81C5E818EA0C32B9048737F23AEA907424D27CAC5FC3F7FF7CFB1DDDAC3444B5E2A24550A9E539CA184EE03B2A293CEC6C3664A6307296916CA12E2CEF94
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........s"..e.....h.....i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....|.....}.................................................#.....$.....&.....2.....>.....L.....].............................q................. .................d.................W.......................c.......................J.....s.................V.................3................. .................0.....H.................C.....W...........?.................9...........&.....I.......................:.............................J.......................(.......................,.......................+.......................,.............................h................. .......................N.......................8.............................i.................*......................._.......................Z...................................4.....Q...........].................F.......................z.......................h.......................N...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\hu.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):532130
                                                                                                                                                                                                                                                      Entropy (8bit):5.642896952429877
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:+3LPGqqITaUM7uedyiwABskitwV5X8CZfpPgcwol44eFgt3jD25TWbtxeIJeDMoE:MPbqwC7nEAvV5X8srwolyZ5qedyF
                                                                                                                                                                                                                                                      MD5:A11A3876D723886FE26BCEAF96EBDE50
                                                                                                                                                                                                                                                      SHA1:99A8E6DEA07EF4A9AE893DE323D77BBF9FB1C7A7
                                                                                                                                                                                                                                                      SHA-256:6E0E56CD8A7D51DFBC325B639426EC748C12783B1AA3B52CB454219B4C37477F
                                                                                                                                                                                                                                                      SHA-512:9CDF2A049ED6C3E5EFDCAA97A09F62678E3539CB001D7C0900BD2C5CFACA50ED8339FF2C8CD7D7A5757EE480A20D053FF5495967D0CE9494A85E447360C91209
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........G"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.&...s.7...t.@...v.U...w.b...y.h...z.w...|.}...}...............................................................................................................................P.....c...........g.................c.................+.................,.....=.................L.....m...........m.................w...........\.................f.................%.......................w...........:.....T...........w.................`.................1.................0.....H........... .....K.....c.............................Y.........../.....E...........P.........................................^...........2.....F...........[.................'.......................N.......................d.................!.................m.................Y.....}.................X.................,.............................0.................V...........&.....Z...........i.................<.......................u...........+.....G.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\id.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):444766
                                                                                                                                                                                                                                                      Entropy (8bit):5.393867703165071
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:BA+QhKMirfjCK2shRxxaJcf+1VnjHFaam4ShIH5XkNkK5im6Gri8YHD5:hQhUjd5fyJnVnjHFXmThQ5XPt
                                                                                                                                                                                                                                                      MD5:D18ECDAC023B3E931E25437F9D4E1C61
                                                                                                                                                                                                                                                      SHA1:F1F8709D1C79F7C9719D351347F554A30C7F59B4
                                                                                                                                                                                                                                                      SHA-256:04CA3B748C947232AA03453FDEFA3A9A0649F7EBB421C69E8DA313A451F8A971
                                                                                                                                                                                                                                                      SHA-512:ABCD58955AEC1173BDD9281A79767BF014FD3590441DFD3C46D2BA8D087F600B182A5F728FBF886BE8B992DC69C70AEE8F932254B3F81A6A963E19A5F5F93FF4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........L"..e.....h.....i.....j.....k.....l.....n.....o.....p. ...q.&...r.2...s.C...t.L...v.a...w.n...y.t...z.....|.....}.......................................................................................................C.....Z.................).....5.................?.....W.................O.....c.................A.....T...............................................,.......................-.............................^.......................R.......................q.................1.....x.......................-.....t.......................>.....g.....q.................P....._.................3.....=.............................f.......................H.......................7.............................].....x.......................9.....Q.................#.....6......................./.....w.......................=.......................<.......................[...........,.....;.................?.....[.................:.....H.............................h...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\it.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):494468
                                                                                                                                                                                                                                                      Entropy (8bit):5.287778145454851
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:Hcm9n+6E26YA7InxNmeXZZBkSOCRxsO1StKV3T9Tj+UhrfxL5Appznw9fLwIIwr8:HB9sveJDr3Zd+8Q8PpsV/52u
                                                                                                                                                                                                                                                      MD5:5F0CBC666753AB15F228E3211DCC2DEC
                                                                                                                                                                                                                                                      SHA1:6AEC86972D0A2CA38D5902792576CB24CEBD858A
                                                                                                                                                                                                                                                      SHA-256:2A800B9823E891C58F509BD8D2BD02F35E9BFD6C6C0B3FF80297170E0762BCED
                                                                                                                                                                                                                                                      SHA-512:8B26CB37D7DBC324EB497DF2BB3F0968E51E5CCAD9E1DD352DD15E30630BE35FE5ACDD9130AD682D4E3742B0029E1C6F2BFE71FAB91474FD411A386C8441FEF8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........d"..e.....h.....i.....j.....k.+...l.6...n.>...o.C...p.P...q.V...r.b...s.s...t.|...v.....w.....y.....z.....|.....}.........................................................................*.....C.....T...........}.................l...................................z...........".......................O.............................g.................!.....~.................g...........6.....[...........*.....p.................A.....{.................h.................O.................4.......................,.....|.......................H.......................+.......................3.............................a.......................5.....c.....l.................B.....M...........4.......................>.....g.............................%.........................................7.....t.................;.....P.......................).................a...............................................c.................z.................).....i.......................k.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ja.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):588953
                                                                                                                                                                                                                                                      Entropy (8bit):5.887882384858557
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:YMCliyUflLzfPC28h69P82ShuLuK8GY4ldW2i1pFBhkkqUtPkwaaWtLnLNH7dPf4:Y1liymlL+280zWK8G7lY15bnzbM5gGV6
                                                                                                                                                                                                                                                      MD5:A0C58016FD56EC2DE8E5C0716D86CB1A
                                                                                                                                                                                                                                                      SHA1:0F1858DA147E039F2B1FFEC2301416A022EDEC92
                                                                                                                                                                                                                                                      SHA-256:6F221C488124761C72FBC888BB670C3774CE738635ECA492C1A6D6E5212DA756
                                                                                                                                                                                                                                                      SHA-512:902E5DFD0A0EA24EDD510FBC4224DF486465BFF216D0C51607B5D606CD30248D8CC095FE1DDD8CC0EAA91BF896720CB65B2016037B9AC5EE727B85AC89C87FAF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....v.....w."...y.(...z.7...|.=...}.O.....W.....\.....d.....o.....w.......................................................................(...........K.................:.............................1.................e.......................%.......................F.......................y.................B...........Q.................).......................I.......................g.............................e.................L.......................l...........(.....C...........V.................e...........Q.....u...........z.................T.................&.................M.....\...........g.................i...........Y.....x...........r.................K...................................F.....d...........p.................[.......................s...........&.....A.................P.....f.......................+...........D.................L.................,.................S.....o...........}.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\kn.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1123255
                                                                                                                                                                                                                                                      Entropy (8bit):4.4105073848379615
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:HPFbSd5sNVbEZLaym4lf2rDb5OjNWBpDPV2hC3hHQqiQO3thUVGkcVw9rqlqAE2i:HdnUDm4lYSQOETM36V725Yq46YV1bae
                                                                                                                                                                                                                                                      MD5:207745B950DC2B2717136EC69843FC31
                                                                                                                                                                                                                                                      SHA1:DD9B15241810EF3793B3BC2F68B34AF1959F0A07
                                                                                                                                                                                                                                                      SHA-256:DC24C1D882B90F8C6B9B7916A0487FC517947DF514D40BDE967FA35F397FA0AF
                                                                                                                                                                                                                                                      SHA-512:DB99B6786D24DFC3EF0EC15D80584F877B4BE73DF7251D60FB4C93D477FE2D8DCA9D2FA04F16DD74F139BFAA50FF325EB04EE9EF630809B97A1B8A42B61C549E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........k"..e.....h.....i.....j.*...k.9...l.D...n.L...o.Q...p.^...q.d...r.p...s.....t.....v.....w.....y.....z.....|.....}...................................................................P.......................e...........j...................................o...........c.............................`.......................=.....*...........t.......................*.............................2.....8...................................\.................................................................+.....v...........g...........L....._.........................................0.....j.....>...........s...........J...........m...........q.....).......................O.................................... ..... .....!....."....X"....."....{#.....#.....#.....$....Z%.....%.....&....A'.....(.....(.....).....*.....*.....+....W+.....,....S-.....-....2....../....C0.....1....^1.....2....E4....C5....x5.....6.....7.....8....%9....]:....B;.....;....5<.....=.....=.....>....Q>.....?....m@.....A....rA

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ko.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):498805
                                                                                                                                                                                                                                                      Entropy (8bit):6.194401428488596
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:++sYKU72P3FRT4XexRS3G0GGRXfwW20t8SQ4E3hpdzYC5ToyogYq5PqJ7JDafnUW:bSU9Wt5MCYI
                                                                                                                                                                                                                                                      MD5:E547C431BF12BF7998BA24319F0AEA51
                                                                                                                                                                                                                                                      SHA1:B771788E59EB06C78003DDAB56DB58AA376ACA44
                                                                                                                                                                                                                                                      SHA-256:FEC2807A2926B53FAB5D08DE4D1D7A601BE54042C559D8BE1BD84FAE7ADFA6D0
                                                                                                                                                                                                                                                      SHA-512:3D426202C4283C6F220C08C7D3A3A780CAA63D7BEF010071B3DB37D7D181EB3CEEDAD1D4C5E46B15230586D111421B51E92B0EF76DDA8B79B8D796D7B7FA7436
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.T...h.Y...i.j...j.u...k.....l.....m.....o.....p.....q.....r.....s.....t.....y.....z.....|.....}.........................'...../.....>.....C.....J.....Q.....S.....X.....d.....t.........................................a...................................H.....\...........,.....n.................@.....u.................D.....x.................V.....{.................t.................!.....x.......................j.......................u.................J.................$.............................i.......................D.......................D.......................l.......................w.......................~.......................{...................................T.....h.................7.....Q.................9.....W.................B.....U...........H.......................C.....W.....d...........$.....N.....a.................K.....f...........d.................).......................J.......................?.......................4.......................K.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\lt.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):532210
                                                                                                                                                                                                                                                      Entropy (8bit):5.631991423045228
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:IWJbleAR4RsOd8d30ORGTkMStNpK8Kg57DH6W1abMD72IV6SbP:1p0tRDaJ7GIRpD5XCb46SbP
                                                                                                                                                                                                                                                      MD5:FBDC6626F74F7DFFFED37C0D7758C5E0
                                                                                                                                                                                                                                                      SHA1:5A57B343EA070756459A02BCED7A09201C8FDF4D
                                                                                                                                                                                                                                                      SHA-256:8E7687BB58BD4719077129B848D94B1162530984367504684DE6F284D74EF232
                                                                                                                                                                                                                                                      SHA-512:8BA55CF62BC298C9985C87A8F365284B7ED33355CE1537B9627F78A9B49F7F10B33522B58CDF685CAEB4DA9047F00C51A2F433E55039F0C3616980F67A08747D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........d"..e.....h.....i.....j.....k.+...l.6...n.>...o.C...p.P...q.V...r.b...s.s...t.|...v.....w.....y.....z.....|.....}.........................................................................#.....7.....H.........................................].....u.............................~...........3.....M...........F.....}...................................W.................*...........=.........................................J.............................&.....i...................................~.................7.................J.....\...........H.....{...................................M...................................O.....`...........d.........................................l...........X.....v...........\.................7...................................D.....\...........j.................L...................................S.....i...................................4.................'.............................;.......................R.....q...............................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\lv.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):531342
                                                                                                                                                                                                                                                      Entropy (8bit):5.639814413486
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:84yZPmGiLwTLfPJoJ28cwv7OoxowNLtVFF+3bmmfYzCDXFfkl5K+t1w3kXWwtznn:smrgfP+BSY3sKyxRkl59hEu1/
                                                                                                                                                                                                                                                      MD5:8659D805388070E922E2D46B918F58F6
                                                                                                                                                                                                                                                      SHA1:FE9DF37FF505AA6B9D93F5B94B2393E8DCA63FB4
                                                                                                                                                                                                                                                      SHA-256:9ADFF43E864B73562ED179080F621F2E46CBBF16100A923C145E965EEA37EDB4
                                                                                                                                                                                                                                                      SHA-512:F45C47470BF3D7CD7D73DE552E134D83428F01AE9C7D8553505C7A6A7BCBD0044138D71E0747DA22CFA2E9E971F20C60D43AF70ECE3407FD762FC953A4E391D4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........v"..e.....h.#...i.4...j.@...k.O...l.Z...n.b...o.g...p.t...q.z...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................".....).....*.....,.....?.....R.....h.......................-.....I...........C.....}.............................1...........A.........................................,.......................x...........(.....I.............................q...........A.....W...........O.................!.................$...........S.........................................$.......................0.......................^...........7.....M...........2.....c.....u...........c.........................................D.............................L.......................y.................".......................^.............................!.....c.................j.................$.......................s...........7.....N.......................%...........(.....^...................................1.......................]...........3.....R.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ml.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1172607
                                                                                                                                                                                                                                                      Entropy (8bit):4.432613876755257
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:j679l3+Js2cMmsbbAUUSVvK3xxn9mMaz++iKf7BOtXIWetjW35pTbHfq3qg9:YGJqSgDKf7BOtXqlW35ZbHi3d
                                                                                                                                                                                                                                                      MD5:DBFB4FBB72FD4357547B1D652C59F5FF
                                                                                                                                                                                                                                                      SHA1:706E80B0306D2E6E1D8B67760C1E9BD6BD173E35
                                                                                                                                                                                                                                                      SHA-256:2BD5644B182FA8A7789CC5DBFEAD20C9A9C5FE2EEBE2128620EBBF770CFFBD86
                                                                                                                                                                                                                                                      SHA-512:023F8A18D2A7D21345B02A50A953B032895C5DE2B6E12AF862D99D199F27D24D09E5E625102A94D87E3625DB4B9CFE84AC93725ABF4CE8D7CFDE508A6DAA1E6F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........f"..e.....h.....i.....j. ...k./...l.:...n.B...o.G...p.T...q.Z...r.f...s.w...t.....v.....w.....y.....z.....|.....}...................................................................F.........................................&.....W.....J...........<.......................T.....^.....r...........Q.....7...........y.......................".....\.....X.......................0.....H...........`.....v.....f...........F.....X.....A.................X.....c...........s...........?.....6...........I...........T...........T...........}...........u...../.......................w...........#.......................U.....6...........~.................t...........-.................2 ....] ....s!....."....g#.....#.....$....>%.....%.....%.....&....^'.....'.....'.....(.....)..../*....s*.....+.....,....1-.....-..........H/...../...../.....1.....2.....2.....2....,4.....4.....5.....5.....7....C8.....9....;9.....:.....;....5<.....<.....=.....>....b?.....?.....@....}A.....A....8B.....C.....D....qE.....E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\mr.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):971427
                                                                                                                                                                                                                                                      Entropy (8bit):4.486525215990573
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:3072:qYRgRgmuZ2Dyw1qQ1HwpnBLh486riYaxSnQ7FCyGRL3RxYR3lDdjENIezRKKcmHb:fRgRg5ZQ1MhsWdoacEzUZESXRGm5RqJk
                                                                                                                                                                                                                                                      MD5:51DD1FB0C908EE57284203DA64CC5447
                                                                                                                                                                                                                                                      SHA1:C6205D457AD8D71CA36B50B8F6AF41EA9CEE60EA
                                                                                                                                                                                                                                                      SHA-256:85A85CE22FDDE81587776E04CF4358F95EE6770E53B643E1653237EC474EAD10
                                                                                                                                                                                                                                                      SHA-512:E2C0677734A07E558CCB33044512E6AB6915D9BCC87FEB93CE2D26D36D2AC148FF8EB4993710F6E63D9F0B0268602B34D199AA47CC51B14793BBA11F6CC28BA6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...|.V...}.h.....p.....u.....}.................................................................X.................l...................................0.....].....3.............................@.......................p.....<...........p.................x...........2.............................1.....4.................).....).................!.....?...........(...............................................Q.......................5.........................................:.....r.....Z.....0.......................S.......................S.......................f.................0.....Y...... ....Z .....!.....!....."....;".....".....#.....#.....#.....$....j%.....%.....&....2'....-(.....(....C)....-*.....*....K+.....+.....,.....-....I............/.....0....L1.....1.....2..../4.....5....?5.....6.....7....=8.....8.....9.....:.....;....;;.....<.....<....5=....^=.....>....s?.....?....D@

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ms.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):463756
                                                                                                                                                                                                                                                      Entropy (8bit):5.288255388108428
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:iJlA3/B2AJu8aexaMxF7TOzGoplz5JN2rl5547KMBIe:iLtuuekMxJTwlzFi56x
                                                                                                                                                                                                                                                      MD5:2869A36C37F1CACA8B842A044E1345A6
                                                                                                                                                                                                                                                      SHA1:68D84231700573EF53D637EABC25B42017699AF9
                                                                                                                                                                                                                                                      SHA-256:46BADD14FE4AD1EC14A441C786C876F707EBB0FF0B64B50D29C8D8EAD2009307
                                                                                                                                                                                                                                                      SHA-512:A3B58F0BDB37C9069B696D322AC0A6D7A2DC7AC52B8117F4885B2D190F1C5886E71E388892BA1E9366E367FD56367BDD16DB063AC006A36AB38483D33FE47FF7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........u"..e.....h.!...i.)...j.5...k.D...l.O...n.W...o.\...p.i...q.o...r.{...s.....t.....v.....w.....y.....z.....|.....}.............................................................$.....7.....K.....e.....|............................._.......................s.................5.................P.....h.................C.....V.................7.....H.................?.....b...........M.......................P.....{................./.....Z.....e...........'.....^.....o...........`.......................V.....q.................".....G.....S.......................(.................).....:.................,.....6.......................).....}.......................m.......................{...........4.....G.......................-.............................a.......................G.......................7.....v.......................[.......................h.................?...................................%.....@.................%.....2.............................S...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\nb.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):453449
                                                                                                                                                                                                                                                      Entropy (8bit):5.432488913598108
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:uy6Flz79l8zDtr0nAl5Op7fyuwm39/x79s5lAr++NFpGio4k:uyAvWr0c5Op7fyuP9/R9s5lA6Skio4k
                                                                                                                                                                                                                                                      MD5:1CF71808F78255795EBED42972C5DCE2
                                                                                                                                                                                                                                                      SHA1:C4811A8E422952FFD37947A1915329DFE598D4E7
                                                                                                                                                                                                                                                      SHA-256:7019CEA86254EE2CF3BBFDCF90F18E565F7EF4F6950FD3842D74D98A81CAB614
                                                                                                                                                                                                                                                      SHA-512:18F31B58036B6CDC92E52E7B63EC0E3346A7089734AE618C5DE3E224745088568797A78DB9B03B543F6D66BC16F5CF5D99CCD4E90E02E5D86AE8922A63852F25
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........f"..e.....h.....i.....j.&...k.5...l.@...n.H...o.M...p.Z...q.`...r.l...s.}...t.....v.....w.....y.....z.....|.....}.........................................................................,.....?.....V...........g.................5.......................q...........D....._...........&.....V.....m...........#.....M.....[.................9.....H.................H.....d...........M.................6.................".................4.....H...........H.................C........... .....B.............................S.......................6...............................................5.......................7.......................5.......................'.......................6.......................d.......................N.......................1.......................8.......................w.......................}................. ................. .....4.................K.....Z...........i.................E......................./.............................t.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\nl.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):467681
                                                                                                                                                                                                                                                      Entropy (8bit):5.364117753758379
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:gafYIt9A2ywQ0QB+OLedgHMHT1f5BPwqSzatKoZ:gSdta2NANKdgO1f5BPwqSzBoZ
                                                                                                                                                                                                                                                      MD5:C2E25BA956D84B20E56CA6D718A65072
                                                                                                                                                                                                                                                      SHA1:09B5BFE151757544BDA4C269CDE436A2C13D8A53
                                                                                                                                                                                                                                                      SHA-256:0AB7821BA8799630702717AF7C129DDB4E57D7147F439D98EA8FEDF5BF364EDC
                                                                                                                                                                                                                                                      SHA-512:0E973599F27EB9E48720B0C0A71557C7E4D71B15C5A901C407C48308347A5FE1BB01EFFCE7D3C9C2B8913B6E18E119FC8E4D95FAD8FDE1D1D346C39895952AE2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........X"..e.....h.....i.....j.....k.....l.....n.&...o.+...p.8...q.>...r.J...s.[...t.d...v.y...w.....y.....z.....|.....}...................................................................................../...........Q.................;......................._.................-.................0.....G.......................*...............................................<.................K.....k...........).....^.....m...........8.....o.................d.................?.......................j.......................<.............................a.......................`.......................Y.......................9.....c.....m.................D.....Q.................A.....P...........,.....l.................;.....h.................!.....B.....Y.................7.....I.................R................. .....>.....R.................H.....Y...........+.....n...................................{...........(.....M.................I.....^.................%.....5.................%.....9.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\pl.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):515341
                                                                                                                                                                                                                                                      Entropy (8bit):5.750423772882207
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:vjrzh6a1y+ogfQfuzSJ46HA9b2lPVe3miUJDMlmw1QhtK5fVW4XbXL:roa1y+sPDM/1Qhs5Z
                                                                                                                                                                                                                                                      MD5:8D9D3641110DFE7B2ACC2D0B8FB37DD8
                                                                                                                                                                                                                                                      SHA1:CE731A70C0ED84F29ABF4BA0FB3D8A4162CFAD70
                                                                                                                                                                                                                                                      SHA-256:5104D100ACB449DA21EB3662E79777281BF90142548B99F081A9DE6F39DCB901
                                                                                                                                                                                                                                                      SHA-512:C0C565438815F6E2215724F2560749432AD4117E3F5C7F85749B98E29CA664F6C91B41FAC6C067D9F3CC33F79387CCEF225B3EEE3288C97CB18B70B57975E306
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........j"..e.....h.....i.....j.&...k.5...l.@...n.H...o.M...p.Z...q.`...r.l...s.}...t.....v.....w.....y.....z.....|.....}...................................................................!...../.....D.....Y.............................f.............................-.....t.................U.......................a.......................l.................).......................e...........).....N.................P.....i...........-.....c.....v...........s.................j...........D.....b.......................:.............................O......................./.......................=.......................9.......................*.............................w.................1.......................Y.......................9.......................%.....x.................G................. .....s.......................S.......................k.................%.................f.....|...........r.................C....................... .....i.......................l.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\pt-BR.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):486039
                                                                                                                                                                                                                                                      Entropy (8bit):5.430710910173115
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:WuaeyGvHSNDhFCNBXBLnkLKx5/JSO3prRRo:WuLvKre5VrY
                                                                                                                                                                                                                                                      MD5:530038CCB23B4ECACFFEE95DD005EC86
                                                                                                                                                                                                                                                      SHA1:60604C19B4CE5B268AE7837497D82F2A7EA95894
                                                                                                                                                                                                                                                      SHA-256:D584759806CC276740368A249ACBED68B1C45E42BDFC3494C49802EA7CFD43CC
                                                                                                                                                                                                                                                      SHA-512:F2E453E71CB231718F1DE0386A91B6C366D35F63117B12305CB2150FB64F8584558CC5CE2B901AF08E9468AA388BE4EA01442B6CF6527AF56623EFE68C3AC75C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........l"..e.....h.....i. ...j.,...k.;...l.F...n.N...o.S...p.`...q.f...r.r...s.....t.....v.....w.....y.....z.....|.....}...................................................................-.....=....._.....t.............................o.............................8.......................|.......................q.......................X.................-...................................J.....q...........E.......................c.................0...................................h.................$.....J.....].................J.....Y.................F.....T.................U.....i.................D.....P................. .....*.....x.......................c...................................W.....p.................1.....F......................._...................................,.............................n.......................r.................*...........*.................'.......................q.......................K.......................F.......................x.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\pt-PT.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):491195
                                                                                                                                                                                                                                                      Entropy (8bit):5.401619117363405
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:YGNaor0bDrrkLHhieJVJJxhD0A+Nfnl25Bf6RV:7KbD/0E25B4
                                                                                                                                                                                                                                                      MD5:3927A10F1865FC9CFDCB37B542F2A76D
                                                                                                                                                                                                                                                      SHA1:ADDE1E056885F0B8D044470C4240C9C2D29BE97B
                                                                                                                                                                                                                                                      SHA-256:F01E25C6F084DEB929A59CECFD891091E74E1E212097BD56EA1F98C093210895
                                                                                                                                                                                                                                                      SHA-512:24102BAB5ECE660D9EEADA176076043FFB06BAAED41E0D4A13269BC47122F13D6FF7D24477C80561F5B4A1A68A67F384007D99C719703C8BF56AF4D82143E873
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."..e.2...h.7...i.H...j.T...k.c...l.n...n.v...o.{...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}......................... .....(...../.....6.....=.....>.....C.....V.....g.....|.............................$.................:.....N...........V.................P.................&.....u.......................T.......................n.................G...........'.....u.................a.......................v.................3.......................x...........R.....m.................N.....f.................>.....M.................L.....Y........... .....Y.....m...........!.....V.....b.................1.....;.............................n...................................>.....P.................(.....D............................._.......................r.................P.......................$.........................................,.....F...........N.................?...................................=.....X.......................+.................5.....N.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ro.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):505232
                                                                                                                                                                                                                                                      Entropy (8bit):5.458485430018358
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:dF6rTrfc2Za+EQKOc6zoBsCjNDOGg5mHzsw2wgJtEA:dMPrfuVQPcOomC1i5mzDA
                                                                                                                                                                                                                                                      MD5:6078D2CCB716D6F7BFD30F6E57DD15B2
                                                                                                                                                                                                                                                      SHA1:3AADED7A34BE101E169F43EE47A1960D9A1E3DA1
                                                                                                                                                                                                                                                      SHA-256:16B7C44ED85EC2374EB0E445BE89919ADF43CDBF6C7FF3D0D9B6970F850B7BD1
                                                                                                                                                                                                                                                      SHA-512:6399E9A55496A8416B3DDEE1515E999562F3D5CD7DAFB2719EBA8BB27FD8C2D345644FED1F76627CD77615B2E1F1F78E20F4131C87DE2958C7811F7776AB9A3D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........^"..e.....h.....i.....j.....k.....l.(...n.0...o.5...p.B...q.H...r.T...s.e...t.n...v.....w.....y.....z.....|.....}...............................................................................#.....5...........M.................&.......................\...........*.....I...........2.....r.................=.....g.....s.................B.....V...........7.....p...........$.......................l.................7.......................C.................W.....q.............................\.......................-.....t.......................K.....r.................;.....m.................5.....d.....y.................G.....W.......................).........................................i.......................<.....R.......................1.................!.....4...........%.....j.................?.....\.....r...........N.......................h.................=.................(.................].................[.......................J.....n.................j.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ru.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):799375
                                                                                                                                                                                                                                                      Entropy (8bit):5.009881641118358
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:KCtCMfQjRo4Ys3dex4jKhFYH1XN2hwO3j/g2CW0GiIlQUeFtU/XHmxdRcYamfLGu:3tlxN+5Jt
                                                                                                                                                                                                                                                      MD5:5D99610AE2FA5CBE69C69FBA955A7DEC
                                                                                                                                                                                                                                                      SHA1:C18A8FE9F5E9EA13FF9ECF61541C350E40555E44
                                                                                                                                                                                                                                                      SHA-256:58EE0CBA98C8F3FF204162C310AD95CA4E01878E0D1AE45D8F3DD10E5639EBAF
                                                                                                                                                                                                                                                      SHA-512:3535082118385ED3B807E9FA0D4AE4E2E9DB461AE3830A14BF1ED9AE68FE7A43FE0D5F3B76E253DFA4D8E45327EE273C8DC4065945BE4C330DBC9009B5F4E318
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!t.e.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.S...t.\...v.q...w.~...y.....z.....|.....}.........................................................................".....:.....a.....V....."...............................................B.............................E.......................6.....Y.................O.....f.......................H.....;.......................x...........]...........9.................?.................!.....N.....R.....L.............................[...................................]...................................V.....{.....!................. ...........#.....^.....u...........r.................@...................................]...................................R.......................z.............................,.................z.............................E.............................k...........h..... ...................................j.............................v...........$.....=.................2 ....n

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\sk.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):516177
                                                                                                                                                                                                                                                      Entropy (8bit):5.803313950656119
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:KFVDn1Kqs9o1MT0Wij5oE70HkTjPxt9V9:Gl1Kqs9oc0N5CUtb9
                                                                                                                                                                                                                                                      MD5:96473E19ED1A105719F2781FD277DAB0
                                                                                                                                                                                                                                                      SHA1:74C4FF294A61FE78B04D774ECB71D697270E5867
                                                                                                                                                                                                                                                      SHA-256:9D89DDED8F132B47940BB1A23D9F95CA31CBDC77B89A199B9FE9D5A6851E1EA9
                                                                                                                                                                                                                                                      SHA-512:32CF62EFDD4FE49520D4EC0BDB4F2FB4255C83201DB2F3D097A3B858AA9C27CFCD4358B1BEB5872621ACF87B3F430C4771D3B82299BF3D93E2E9E1C6E2BD4BFE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........d"..e.....h.....i.....j.....k.....l.9...n.A...o.F...p.S...q.Y...r.e...s.v...t.....v.....w.....y.....z.....|.....}.........................................................................'.....9.....N.................&.....D...........%.....W.....e.............................X.......................x.......................~...................................#.....H...........b.................R...................................6.....G...........N.................<.................5....................... .....|.......................u.......................w...........1.....G...........$.....Y.....j...........0.....\.....i...........M.......................l.................K.................4.............................d.......................W...................................=.....r.................7.....L...........*.....Q.....g...........Y.................[...........Y.....n...........\.................'.......................$.....z.................7...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\sl.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):500017
                                                                                                                                                                                                                                                      Entropy (8bit):5.492024915324522
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:yKBu7kzoYlJ2cB2xU4nhv5PWJU8Zi/fzrs:ycu7OJlJKzhv5ii/fzrs
                                                                                                                                                                                                                                                      MD5:32C105451978777FDFB47E704160E8AB
                                                                                                                                                                                                                                                      SHA1:A1554F3165CA1448627199D30D24D2412DB62685
                                                                                                                                                                                                                                                      SHA-256:B3DC5D4422CBCB66B9800F75C1536546257649B5653CCAE0FD75E723818CFF0C
                                                                                                                                                                                                                                                      SHA-512:89533C24FC8E3BB2343F6DF1DA04E217B6ED0B0E898B8489E11B32FEB88F54230963255805339FD52B8E5C5F9CB5249074FD07CC669684A056C37E7638FED65E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........S"..e.....h.....i.....j.....k.....l.....n.....o.....p.,...q.2...r.>...s.O...t.X...v.m...w.z...y.....z.....|.....}.....................................................................................'...........F.................".......................\...........&.....E.................E.....X.................;.....H.......................=.................T.....z...........g.................5.......................]...................................B.....\...........u.................N.......................,.............................r.................#.......................F.......................c.................(.......................%.......................).................A.....[.................0.....H.........................................4.....F...........'.....b.................D.....d.....z...........P.......................f.................a...........y...........B.................U...........,.....`.....p.................1.....A...........!....._.....u.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\sr.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):747984
                                                                                                                                                                                                                                                      Entropy (8bit):4.952924997082728
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:1bLRqBFpISWdVGCn++5nEJxVPu3779nZ/k/F:1bLRcp+50N
                                                                                                                                                                                                                                                      MD5:4F0C697FC981920CDC2BDFDFB9882858
                                                                                                                                                                                                                                                      SHA1:07A50D541CB4FF5284F35230CC1C13ED06B5A525
                                                                                                                                                                                                                                                      SHA-256:6F8849D573513F3371101BFD096C635B832AC29DAEC6C49B9AF9147689785050
                                                                                                                                                                                                                                                      SHA-512:C4DAE708F9D6601C59E56978FC0AA6659F984B1BCE442E21D7365CDBA61219C425F7A75DA961BA637707AE178FC2A5CE8130D354427B7155D2060E329096838D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........i"..e.....h.....i.....j.&...k.5...l.@...n.H...o.M...p.Z...q.`...r.l...s.}...t.....v.....w.....y.....z.....|.....}...................................................................<....._.......................n...........&.........................................t.................!.................u...........P.....o...........r.......................6...................................W.......................?.........................................6.....i.....u.....M...........*...........*.....b...................................r.................:.......................*...........U.................\...........%.....@...........].................i...........B.....c...../...........Z...............................................2.....e...................................t...........0...........9.....p..........._...........@.....m.....L...........M.....~.....k.....:...................................? ..... .....!.....!.....!....."....."....,#....I#.....$.....$..../%....\%

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\sv.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):455921
                                                                                                                                                                                                                                                      Entropy (8bit):5.5313918592510705
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:qeI0OC916u+0mJSPPd//e2K6XwOlPkS1yY59RtGl5QSOLo53gonNsy2IbXq:qWOWobN+1Tgr55nRu
                                                                                                                                                                                                                                                      MD5:5510D0959463030C44A5A8F5CC8B2B4A
                                                                                                                                                                                                                                                      SHA1:2466873F3F722CFF74C8DA5DD08B192EED639974
                                                                                                                                                                                                                                                      SHA-256:359DB78BD78A11A719C908B81DDD8E6D5A25E6775275E26472EFE8666E9A8CF9
                                                                                                                                                                                                                                                      SHA-512:96479FAC97013F6B16D1614FD1BAC849BFA872A27AA97C63B747B2FABFF5EDCAC27E0F563E9C15FBFAC92EE61C96A805FCAE6EC17DA7F8A3E822BD778555F722
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........3"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~.......................................................................u...........C.....Y...........,.....j.....{...........z.................O.......................\.......................\.......................v.................;...........).....l.................G.....u.................b................./.............................8.......................X.....w.................9.....^.....l.................=.....L.................S.....e........... .....N.....].................=.....L.................-.....=.................2.....A.................O.....d................./.....H.............................g......................._...............................................{.......................y...................................v.................v.................A.......................0.............................j.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\sw.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):477303
                                                                                                                                                                                                                                                      Entropy (8bit):5.36238063917783
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:AFfk0H4yc0o/G5ABqMCBfRdwFUWbQW4Xj8Ag8hUWx/gYgsS5NLdEP66eEeI9Hj9V:YgH/B5O
                                                                                                                                                                                                                                                      MD5:1CCBDD3FD9B49C2258F258AA914A421F
                                                                                                                                                                                                                                                      SHA1:47AF913B11DDBE3F46CA09D0801A3887CF8C1F7E
                                                                                                                                                                                                                                                      SHA-256:28553BA4E42EF541832BAE9A848821C1B450083C341B94B6B57046F450090B4E
                                                                                                                                                                                                                                                      SHA-512:E1688A2426378E79CFC3334554428EBB11FBF3A531B5EC41AF082912D25C95BED2E1D901F9236954B9E60137A61C26915DCE8D19B7F7889B48347C20AC4E9200
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........Y"..e.....h.....i.....j.....k.....l.....n."...o.'...p.4...q.:...r.F...s.W...t.`...v.u...w.....y.....z.....|.....}...............................................................................%.....<...........E.........................................O.................(.......................#.....z.......................^.......................c...................................e.................O.......................Q.......................Y.................7.................,............................._....................... .....l.........................................3.......................4.......................2.............................|.................7.......................c.......................h...........................................................A.....s.................5.....G.......................0.................V.....y...........s.................Y.................!.................].....t...........0....._.................j.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ta.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1171465
                                                                                                                                                                                                                                                      Entropy (8bit):4.216719565613966
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:S8s34dUA+Npdg0VweO5ntRItm1vYpiMyb:S8ktA+NIwfO5Itm1vYpiMyb
                                                                                                                                                                                                                                                      MD5:717BE91F3F316E472A53E59E88CB5FDA
                                                                                                                                                                                                                                                      SHA1:36F0D5BE3DF774EE3B107CD9F66F6F1A760BF918
                                                                                                                                                                                                                                                      SHA-256:01F3A10296400C10A24D8F5912F01A5BD48B3C0EB912F2AEB2E9746771A4F03A
                                                                                                                                                                                                                                                      SHA-512:42C85FC01F626633EF77B7882B83653E6AD7B5C911B816492B524BFDBA0E5A925EEC171AEC82478D2FC590FC87BE6E215F94C28F300BEBE0AE16F205903E24E8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........9"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.&...v.;...w.H...y.N...z.]...|.c...}.u.....}.......................................................................Q...........M.........../.....a.............................e.......................,.....b...........0.....1.....$.........................................O.....S...........>.............................;.....Q...........7.....x...........C.....t.......................L.......................U.....X.....!.....u.............................$.................B.....v.................=.................q...........$.................p ..... .....!....."....."....3#....-$.....%.....%.....%....&'....w(....S).....).....*....z+.....+....+,.....-.....-....2...........X/....A0.....1....Y1.....2.....3.....4.....4....p5....66.....6.....6.....8.....9.....9.....9....h;....{<....\=.....=.....?.....A.....B..../C.....D.....E....MF.....F....-H....SI.....J....dJ....hK....UL.....L.....M....GN....vO.....P....XP

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\te.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1082557
                                                                                                                                                                                                                                                      Entropy (8bit):4.476468932794146
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:8GZ66H7McKN0UQGXF3p1FoOttJjgu3PifrOXHXAAYQzZFRIa+Z8zXfXw3mqd0yT+:8ITHlAi5G
                                                                                                                                                                                                                                                      MD5:B54CCAC0C52F50D551873B86B405A112
                                                                                                                                                                                                                                                      SHA1:C40999D91E1A64EC9732E2D7CFEDC6AF3413D42F
                                                                                                                                                                                                                                                      SHA-256:CA26A805D4C8731EC42A59BE0BF921FE10492832F87E0133A4A5D287ACB38BB8
                                                                                                                                                                                                                                                      SHA-512:F5D35D429FAF2DBF7949DBAE28BCC59DF88903DF8C8D24E4CD877D33F43CD8470E434D5D27EFC328B3C7014F90334397659EA337CA52C953CE9BF082B44EAA3B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........w"..e. ...h.%...i.?...j.K...k.Z...l.e...n.m...o.r...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................&.....-.....4.....5.....:.....q.................4.............................l.....^...........G.............................I.....b...........<.......................O.....^...................................B...........%.....O...........{.................;.....|.................?.............................T...........:...........t....._...........d.............................3.....G...........w...............................................e.............................U.....t ....D!.....!.....!....!#.....#....o$.....$.....&.....'.....'.....'.....(.....).....)....6*.....+.....+.....+.....,.....,....}-....>.....v....../.....0....]1.....1.....2.....3.....4....W4.....5....u6.....6....F7.....8....I9.....9....,:.....;.....=.....>.....>.....@.....A....EB.....B.....D.....D.....E.....E.....F.....G.....H....VH.....I.....J....YK.....K

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\th.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):915564
                                                                                                                                                                                                                                                      Entropy (8bit):4.5455629425761215
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:BN9LyZYAJTozrZGbMTB5UsSpL3f3j80RUOwunRIOG4LwNw11j7KQe9d8xR7kB/1u:Z0IO5d
                                                                                                                                                                                                                                                      MD5:472ED6BAEB5182C06AA1C25F0D1F77E5
                                                                                                                                                                                                                                                      SHA1:EAD1B4310663FF8CB2069E53A417C358DA916134
                                                                                                                                                                                                                                                      SHA-256:F2148873D908C0CBB02A90B242C326D0A627CA1A470319613FD75DDC14E2AF10
                                                                                                                                                                                                                                                      SHA-512:1CB0462F8CA3EA65B2453FDABCF0FB6976E223842E627FCD0C73E4546358A3AF8B0F25110C91BBCAA717302045017E70367344C422CFA979DAF841C554997CEF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.n...h.s...i.{...j.....k.....l.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.+.....3.....8.....@.....K.....S.....X.....`.....g.....n.....u.....w.....|.......................c.....t.....K...........".............................(...............................................w...........D.....e.........................................B.................E.......................y...........................................................5.....m.....\...........Z.....9..........."....._.....+...........F.....g.....'.................6.................>.....h.....:...........[...........K...........l...........F...........;.....V.....+...........L.....s.................N.....v.....0.................5...........q.............................v.................{.................&.............................c ..... ..... .....!....r"....."....7#....:$.....%.....%.....%....9'....*(.....(....K)....>*.....*....o+.....+....U,.....,....H-....g-....p.....9/...../

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\tr.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):484626
                                                                                                                                                                                                                                                      Entropy (8bit):5.620497006386795
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:Hs5kMLND6qwPOV0HzNs7DxEoOF5yPulI56:M5XRiPOVXulI56
                                                                                                                                                                                                                                                      MD5:6702F4F351C4FFB16DF253DD34E4AD74
                                                                                                                                                                                                                                                      SHA1:6A5E9D6D0E631AF7C9586185B76736168C067F0A
                                                                                                                                                                                                                                                      SHA-256:B1418FAED26174B8E4C395D6B25F43B8ADF86A7EF8ABE5C8A9D31415A0FE6425
                                                                                                                                                                                                                                                      SHA-512:483DEF8555BE3373A329F7C6973E57AFB9A85926C212EC873D9686CFF0289A31FD74FBF7ADEA1D8896114080AF535E42A0698B45B03163CB9F318DA46CD0D78A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........|"..e.*...h./...i.@...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................%.....,.....3.....4.....6.....N.....d.....y...........'...................................%.....6.........../.....w.................S.......................J.....q.................6.....c.....u...........E.....w...................................Q.......................P.......................].................).................`.....x...........8.....b.....~...........=.....l.....}...........9.....g.....w...........B.....y.................U.......................^.......................Y.......................Z.................$.......................r.......................s.......................S.......................f.................-.............................k.........................................6.........................................U.....y.............................H......................._...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\uk.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):798829
                                                                                                                                                                                                                                                      Entropy (8bit):5.04120069425706
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:LzBoWC5HA4jidJFfsSr+NnpDuJyZ3IhYHy54B3IjoGALLluALNiXEBqPV68z+4u8:Lz2WC5HAHqq5p
                                                                                                                                                                                                                                                      MD5:E4AFBFA7B869763D0D38759F0DCA6987
                                                                                                                                                                                                                                                      SHA1:04745E3E5C092524C14C86DAD196339C36A26229
                                                                                                                                                                                                                                                      SHA-256:3EBB03A763D78F89FBE67D6C90BB945F6721DC1404ED72C771977A9AC2DFDF86
                                                                                                                                                                                                                                                      SHA-512:70EE290500C7187C2572BDCCD7F67C92C3F484BC047701E44B2C8409AE23769D2DB6A15B0EACB0A0721525ADF18FADB6826E456BF9C741E79BAA678460BDCE84
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........,"..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...|.I...}.[.....c.....h.....p.....x...........................................................=.....(...........~...........b...........h...........].............................,.................w...........^.........................................l.............................-.....i.......................;...........z.......................g.............................>.....x...........q.................b.................?...........>.....|...........N...........L.....s.........................................X.....q.............................t...........B.....].....V.....&.............................G.....i...........?.....h...........;...........Z.....u.....j...................................B.....o...................................c.............................n...........}.....A.......................J ..... ..... ....K!.....!....."....$".....".....#.....$....L$

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\ur.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):702593
                                                                                                                                                                                                                                                      Entropy (8bit):5.327622167881952
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:prGykn+8P2ZRdH4ytc0g5B4EhE1GlcQYrfNowadcJKwUiu1co/9NjjFpX3J:prpk+o52K
                                                                                                                                                                                                                                                      MD5:7132A848A81688783156A1BA38F29513
                                                                                                                                                                                                                                                      SHA1:E293F1211085F9F9ECC1C354986481CF0CF17561
                                                                                                                                                                                                                                                      SHA-256:4EAB97BB6C81CA80ACF69508A168DEE3B69B19ED314E7E15CB22BEC9C9DD5F16
                                                                                                                                                                                                                                                      SHA-512:F4F9EFE902FDDC07EBD07089C92D0C6CC1D1E4CE4AB1EAC01A745BCE01C35C66150EA864455DE80E27760774B966839354D9868167BD1107A4574A9BBAB81190
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........W"..e.....h.....i.....j.....k.....l.....n.....o. ...p.-...q.3...r.?...s.P...t.Y...v.n...w.{...y.....z.....|.....}...............................................................................8.....].....4...........n...........Q...........a...........d.....!.......................(.................E.................2...........A.................>.................,.......................+...........i.......................&.................v.....1...................................B..........."....._.................r.................K.............................4.................;.................9...........D................./...................................].....y.....>...........f...........+...................................%.....S...........Z.........................................R................."...........Y.......................!.......................R...................................F.......................<...........K.................b...........I ....o

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\vi.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):568015
                                                                                                                                                                                                                                                      Entropy (8bit):5.821338862482426
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:ylmTSR+cQhQSw9R/6hJ7nU1fuwQL5FEisTZ0WiIr28Vt4ku:6R+cQhQ7RyhJgJQL5miQ6Wie28Vt4ku
                                                                                                                                                                                                                                                      MD5:C490E9E983DB2B3A743FBC29CC3E8E43
                                                                                                                                                                                                                                                      SHA1:D7521E74ABC81907F5C49DBA683892AC758D9A1C
                                                                                                                                                                                                                                                      SHA-256:CC16DD44E481F28743F841F41A3443CDDE6EBDA6914BD44B3F875A77AD2F2A3D
                                                                                                                                                                                                                                                      SHA-512:25FDC04E8C25F43E196E00ADCCF8BE783B921F973B903449AAE96E4623DDD4EA3820E8DDF7414FE1094119D6BA57D09A99E6A871850E083FDFCB2507A5D90071
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........."+.e.l...h.q...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.4...}.F.....N.....S.....[.....c.....k.....r.....y.....................................................M.................p...........E.....\.......................(...........).....{.................=.....c.....o...........E.....}...........0.................,.......................,...........=.................-.............................9.................r...........o.................m.................%.......................@...................................C.....Z...........0.....g.....x...........B.....v.................O.......................t.................p...........v...................................T.................].................)...........f.............................6.....X...........U.................L.................)...........q.......................W.................s.................*.................0.....D...........v...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\zh-CN.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):421196
                                                                                                                                                                                                                                                      Entropy (8bit):6.763468661588106
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:S9jv7gR4VuSlg9akb7v57wTTHV2Bj5/uiA05mQFxlf:ejcOjG9Zf57ITH4Bj5/vA0gI
                                                                                                                                                                                                                                                      MD5:B17947A289AFEB76C2F3FDBF922B0103
                                                                                                                                                                                                                                                      SHA1:342D989FBD64A11293C86C133859FFB1BDEDE082
                                                                                                                                                                                                                                                      SHA-256:A2D5E554AA24DD03CC6065A7F1B243C5664CECD112A352B0E81131060AB1B557
                                                                                                                                                                                                                                                      SHA-512:A2916A36417727AB2C126AE3486C35DDDE8D8FC101DEB9C83BF505DF3DBA432787BCFCE32E00DADA3647E5BF12930FA25F3BFB08DA9DFAD758D25739972F0E88
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!^.e.....h.....i.....j.....k.%...l.,...m.4...o.:...p.?...q.E...r.Q...s.b...t.k...v.....w.....|.....}..................................................................................... .....2...........C.......................b.......................i.......................r.......................q.......................<.....c.....p.................C.....]...........8.....y.................G.....{.................-.....V.....b.................H.....Z.........../.....m.......................(.....B.............................Q...............................................6.............................n.......................L.....t.................%.....N.....Z...........@.......................0.....P.....d.................1.....H.................#.....5.......................6.............................R.......................R.......................n...........'.....9.................=.....R.................(.....7.............................U.......................Q.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\Locales\zh-TW.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):417758
                                                                                                                                                                                                                                                      Entropy (8bit):6.769124970408262
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:zEqYoFziebkrJbKFznD35JN0PulyTW5BQCISAo4ideykKTd:z/FeR1qD95yTW5BQgai3
                                                                                                                                                                                                                                                      MD5:FC46455B327A49079BD8DCE3847DFE36
                                                                                                                                                                                                                                                      SHA1:67DEEFDA6E18028EDD502A60F0417D291CD150F5
                                                                                                                                                                                                                                                      SHA-256:7FBE592E2FAC0393E4361B74645A97A81B1B7087653D2BE8F08D2C9C546462D3
                                                                                                                                                                                                                                                      SHA-512:AD5008733A0668A6A22EFA89DC76403B4278553167989826054387F50F72C6243DDD8295300DDA348ADECA8C939A82F2A7EC58553F61F189027B7114EDF9464D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.,...t.5...v.J...w.W...y.]...z.l...|.r...}.....................................................................................g.................0.............................o.......................k.......................S.......................).....y.......................W.....}.................T.......................K.....y.......................W.....c...........).....^.....p...........H.......................$.....8.....L.............................^.......................2.............................d.......................M.....|.......................V....._.................0.....<.................9.....M............................._.................'.....y.......................b.......................<.....P.....\.................).....;.......................7...........#.....l.....{...........J.......................M.....v.............................%.....|.......................l.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\MEIPreload\manifest.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):238
                                                                                                                                                                                                                                                      Entropy (8bit):4.824253848576346
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6:v5975JVSS18iMkh26VlcmutLwyAGI/zj//gQNMC:Bbt18l+LlMLqGU/gQNMC
                                                                                                                                                                                                                                                      MD5:442699C95B20A60470421C6A4D29960F
                                                                                                                                                                                                                                                      SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                                                                                                                                                                                                                                      SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                                                                                                                                                                                                                                      SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\MEIPreload\preloaded_data.pb

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8254
                                                                                                                                                                                                                                                      Entropy (8bit):6.795641289553097
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:192:bTOpyeS7AOv6EVp/m3FPKk15jjKVcOmQppXavFbeLfzrLyp:bTOk7AdEugo5jjK+5QppXaBebzrLyp
                                                                                                                                                                                                                                                      MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                                                                                                                                                                                                                                      SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                                                                                                                                                                                                                                      SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                                                                                                                                                                                                                                      SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\d3dcompiler_47.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4916728
                                                                                                                                                                                                                                                      Entropy (8bit):6.397948646164362
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:49152:xCZnRO4XyM53Rkq4ypQqdoRpmrgBVYvkaRwv/ZD0/WYLDltog/RfznLeHTRhFRNI:YG2QCS6HHzog/pznA7T6VP
                                                                                                                                                                                                                                                      MD5:03A60A6652CAF4F49EA5912CE4E1B33C
                                                                                                                                                                                                                                                      SHA1:A0D949D4AF7B1048DC55E39D1D1260A1E0660C4F
                                                                                                                                                                                                                                                      SHA-256:B23E7B820ED5C6EA7DCD77817E2CD79F1CEC9561D457172287EE634A8BD658C3
                                                                                                                                                                                                                                                      SHA-512:6711D40D171EA200C92D062226A69F33EB41E9232D74291EF6F0202DE73CF4DC54FBDD769104D2BB3E89DC2D81F2F2F3479E4258A5D6A54C545E56B07746B4C4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: Shift - Recipes_spn7g.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: SecuriteInfo.com.Win32.MalwareX-gen.8794.16509.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: SecuriteInfo.com.Win32.MalwareX-gen.8794.16509.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: DeepLSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: DeepLSetup.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                      • Filename: , Detection: malicious, Browse
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...;............." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxcompiler.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20706816
                                                                                                                                                                                                                                                      Entropy (8bit):6.4939241014905225
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:393216:cKV1k/sH0XmVIOTkk+216gPgmhae7/Qf28EqDPHnUof+8gnISe2OCcmaaRXBxUl4:P86ypct
                                                                                                                                                                                                                                                      MD5:5F37AB4B71E09FD9D7AC3FB41EAC789A
                                                                                                                                                                                                                                                      SHA1:40CD31282F8CA90E7A0FC909794DBBEF41F064B3
                                                                                                                                                                                                                                                      SHA-256:3D79528D0EA2F5B50F6E9A38842C470AD380862E12E94386A620A33C0FBC205C
                                                                                                                                                                                                                                                      SHA-512:A9F1FCEDD4BE1DE0458184D9A7C39AA838DBE5E72C3AECBB6739B433AC59E10FE650BA27B48ADD58F410AC7B06B7A78DEDE01BAACBC6F69B90C3BDD8E0E39C21
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........." ..........C...............................................<...........`A........................................P...p.......x....p;.......1.p_............;......r..8....................q..(...0...@...........................................text...&........................... ..`.rdata..p.8.......8.................@..@.data.........0..n....0.............@....pdata..p_....1..`...B1.............@..@.gxfg....0....;..2....:.............@..@.retplne.....@;.......:..................tls.........P;.......:.............@..._RDATA..\....`;.......:.............@..@.rsrc........p;.......:.............@..@.reloc........;.......:.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\dxil.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1508360
                                                                                                                                                                                                                                                      Entropy (8bit):6.500862796533265
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:MCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkrP:MCfhbh3v3mtEAQrW41obCraeRhy9ou69
                                                                                                                                                                                                                                                      MD5:57E915183AA06BDF5B68C9702999CE0E
                                                                                                                                                                                                                                                      SHA1:FA2B5CC5AD6B8ED410C6AA4D6BF9EA2F42085E3F
                                                                                                                                                                                                                                                      SHA-256:80F86540D2A8A651C433507229DD356209BACC0155B10BA59956763F6D0D485B
                                                                                                                                                                                                                                                      SHA-512:F25AD8281C3CDB2B67F3A23761D8AC18720AFBC14499C26FFF7BF7BDD4F0833D75E44A74EE67461EB038E734A8193BD45762FD39471769076B4451CB1B6F0DB9
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@AC.. -.. -.. -.OX).1 -.OX... -.OX(.. -.VU(.. -..R,.. -.. ,.. -.OX$.. -.OX-.. -.OX.. -.. ... -.OX/.. -.Rich. -.................PE..d...'..}.........." ........."...............................................@............`A............................................l...l...P............`..t........&... .......o..p....................o..(....m..@............................................text...\........................... ..`.rdata..F...........................@..@.data....{.......T..................@....pdata..t....`......."..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\eventlog_provider.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6144
                                                                                                                                                                                                                                                      Entropy (8bit):2.3230050388772105
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:vpg3MYy3YCtq1EZU9qZ44T1beGC+gYT4PAXGja:BJf3YTOWqSui44
                                                                                                                                                                                                                                                      MD5:621AEB0EDF960DDA00C1E3E8C6FA931A
                                                                                                                                                                                                                                                      SHA1:CFC5B295341FC29656E67318D6E7778CF7215942
                                                                                                                                                                                                                                                      SHA-256:818CA5B480BC8651291B6C98FCE33555D54A2C26B2BFE0B407AA09557B17BB5C
                                                                                                                                                                                                                                                      SHA-512:B075E884DA36C2FBDFC302DF55355B6963B7C44763422970C180B30227E70E3607341C9ACE8983D68C174EE673CDCB6BA5DF407AB4C8110EA16942C6A172CA56
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........." ......................................................................`A........................................0"..T............`.......@...............p..$...@!..8............................ ..@............................................text...V........................... ..`.rdata....... ......................@..@.data........0......................@....pdata.......@......................@..@.retplne.....P...........................rsrc........`......................@..@.reloc..$....p......................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\icudtl.dat

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10468208
                                                                                                                                                                                                                                                      Entropy (8bit):6.265606239082294
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:196608:+SPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2Y6U:++wkpHiXUxY/iJ53IWhlVjEeIZU
                                                                                                                                                                                                                                                      MD5:FFD67C1E24CB35DC109A24024B1BA7EC
                                                                                                                                                                                                                                                      SHA1:99F545BC396878C7A53E98A79017D9531AF7C1F5
                                                                                                                                                                                                                                                      SHA-256:9AE98C06CBB0EA43C5CD6B5725310C008C65E46072421A1118CB88E1DE9A8B92
                                                                                                                                                                                                                                                      SHA-512:E1A865E685D2D3BACD0916D4238A79462519D887FEB273A251120BB6AF2B4481D025F3B21CE9A1A95A49371A0AA3ECF072175BA756974E831DBFDE1F0FEAEB79
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E...(...E...)...F...).."F...1..5F..`1..EF...N..XF..PN..hF...N..xF.......F.......F.......F..@....F.......F......F..0....F.......G......$G......7G......JG......]G..@...pG.......G.......G..@....G.......G.......G..@....G.......G..p....H..`....H.......H..@...AH......TH..p...gH.....zH.......H..`....H.......H.......H..P....H.......H......H..`....I......%I..P...:I......RI.....bI..@...uI.......I.......I.......I..P....I.......I.......I..0....I.......J... ...J.. !..-J..@$..=J...$..PJ...$..qJ.......J...<...J....&..J....&..J.. .&..J....&..K..`.&..K....&.3K....&.JK..0.&.aK....'.xK....'..K....'..K...(..K....(..K...O)..K....)..L..0Q*.>L..`.*.gL..Pi+..L....+..L...i,..L....,..L..P}-..M..@.-.,M.. .-.EM....-.\M....-.uM....-..M...$...M..0%...M....0..M...j0..M..`.0..N..p.0.1N....0.AN....0.TN..@.0.iN....0..N..0.0..N....0..N....0..N....1..N....1..N..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libEGL.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):492032
                                                                                                                                                                                                                                                      Entropy (8bit):6.3407676042199554
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:uj3uePHG5O+UupSawLNP77aL7ZWY6Hjw00Qir7wue/FzijAssNXXrC:KfPGg+UiSawL5aLFJ6Hjwj7+xNXXe
                                                                                                                                                                                                                                                      MD5:4657782C414EBF4732168BEAD0DE6B96
                                                                                                                                                                                                                                                      SHA1:C24E4AD53C348CA9CDBC836EDDBD6F990F93BFBB
                                                                                                                                                                                                                                                      SHA-256:D4B54F37A45BB92C4B3D34514AFBC54C6698663298C797562ABB6C0389026F5F
                                                                                                                                                                                                                                                      SHA-512:78BF512F0539F7535E1E7A49CD874473C3BBDB7D682914ED56297B24D37C2630729F2A7328930394B3CCE1261BCFB2B3ED8C61B9E0B87F20AAEEB9CDC42D7F99
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........." .....d................................................................`A........................................`l.......z..(.......`....P..`?..............8...\d..8...................@c..(.......@............}...............................text....b.......d.................. ..`.rdata..dv.......x...h..............@..@.data...tK....... ..................@....pdata..`?...P...@..................@..@.gxfg... &.......(...@..............@..@.retplne.............h...................tls....!............j..............@..._RDATA..\............l..............@..@.rsrc...`............n..............@..@.reloc..8............t..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\libGLESv2.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8315904
                                                                                                                                                                                                                                                      Entropy (8bit):6.457097467253513
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:196608:vqqGIY8NyDVG11pZYW+j/0FxQ8eKPemm:vqqGIY8NyDVG11pqW+j/0FxQki
                                                                                                                                                                                                                                                      MD5:48EBD9A37518F36D055D144ABC3887E2
                                                                                                                                                                                                                                                      SHA1:880F86EB22B10763AF655D8EAD72EDC081D75574
                                                                                                                                                                                                                                                      SHA-256:F77B143796747622723FDF8FAD2388F2C3E9C3FD97967613C62BCE32C9037771
                                                                                                                                                                                                                                                      SHA-512:56E60C644AF002E4ECDB92CB99A503B87E1ADCEF4697B5B51B659B221408FD4AE053C823026EFE7952C4B1E5A7ED7FCEF2CC88FEA639EC8AD4AECA2003B4EDDD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........." .....\b.........0._...................................................`A.........................................Vv.....(5w.d.....~......@|.4B..................|.u.8...................P.u.(....qb.@........... :w.....0Uv.@....................text....[b......\b................. ..`.rdata.......pb......`b.............@..@.data........ x.......x.............@....pdata..4B...@|..D....{.............@..@.gxfg....-....~.......}.............@..@.retplne......~.......~..................tls....B.....~.......~.............@..._RDATA..\.....~.......~.............@..@.rsrc.........~.......~.............@..@.reloc................~.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\mojo_core.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1641984
                                                                                                                                                                                                                                                      Entropy (8bit):6.436104573762728
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:dEizgPYbqjeIti9DOXnOMiQFxbJkHDqByqRLgDDQTi4dle:dEizyYbqiIti9DOXHB92HuNJyDci2
                                                                                                                                                                                                                                                      MD5:936C6EE797EF7C813499319EDC9921EA
                                                                                                                                                                                                                                                      SHA1:21475CD75B551695282C653D89C81FDF50E731DC
                                                                                                                                                                                                                                                      SHA-256:84BE9966D29A0D7CC0F9F0BBFDCAA83BE9D877D493DE74308DF51D3EAA05EF2D
                                                                                                                                                                                                                                                      SHA-512:B08DF2F17BB61F9A167522454FF5557F86833FD43F53628845586C9567A2343EF998A1D9DAC9F5928FD8BAE86C4DE20C79B96DEA6899D6E4B3FA61C29D3515F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........." ................`........................................ ............`A.........................................z..p...@{......................................i..8....................g..(....A..@...........p................................text...&........................... ..`.rdata..d....0......................@..@.data........@....... ..............@....pdata.............................@..@.gxfg....*.......,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\notification_helper.exe

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1249792
                                                                                                                                                                                                                                                      Entropy (8bit):6.390068266146552
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:v19DZ3sMJLrbqV5IFCahGnBFwvK9Z89yrUvB:v19N3sO6V5ItGnGKL9E
                                                                                                                                                                                                                                                      MD5:EA381C83145E4D090D2E5D9B640E6B6D
                                                                                                                                                                                                                                                      SHA1:008BF81C63A6123E7F2B37867CA1756C5400BB3E
                                                                                                                                                                                                                                                      SHA-256:48034FFD6D29C77E2C43CC1ECC74782360B93AFB046A08817F542C1362947453
                                                                                                                                                                                                                                                      SHA-512:57B233FDE6870D8CB01FA98B34588BD0E6664B4875EAB95808B3E7C82AB9989889003A028BB668E716A2FA736E9E11BCA11CE7DD13DC809896D6545B88A84440
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........."......x...........9.........@.............................0............`............................................\...<........... ........~............................................(.......@...........8................................text...Fw.......x.................. ..`.rdata...............|..............@..@.data........p.......N..............@....pdata...~...........<..............@..@.gxfg...@-..........................@..@.retplne.................................tls....r...........................@...CPADinfo8...........................@..._RDATA..\...........................@..@.rsrc... ...........................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources.pak

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8791656
                                                                                                                                                                                                                                                      Entropy (8bit):7.996877388308785
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:196608:bK4Tqpitix5RB8U+mqpcVk1gG1WKM5kr+gNdDnxxY+Tmi:bK4TqpitS5tqeG6iGkr+uxxdn
                                                                                                                                                                                                                                                      MD5:AB2651AD184EB64EF00FDC40C4C5D038
                                                                                                                                                                                                                                                      SHA1:1092B5495B7B3CF1E74949F286C6914EC9FA37EB
                                                                                                                                                                                                                                                      SHA-256:5373BE2EBA649E3F50FBBC3770C4B84A5421AC4DD5B6EBC5562F30B01C8E74F0
                                                                                                                                                                                                                                                      SHA-512:F4ECF87BF6E55B9ADC246C3695425C841C3E47AEB60B85055926B5581CDD0839A99A838FB1240C892975281FC409D88E10D35A44C8DEB78A2B556866D71F655D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........#...f.@C..{..M..|..P..~.0T.....f.....h.......... ...........y.......................L......4.....7.....8.....:....BC....XD.....E....;G.....H....NK..........L..........c.......................^.....*....C.....C....#C,...$C....%C....&C....-C?....C..../C....0CN...1C....2C....3C....4Cu%..5C.3..6C.H..7C-_..8C/t..9C....:C....;C...<C...=Cz...>C....?C....@C]"..AC.8..BCiP..CC8i..DC.|..EC4...FC8...GC.....D.....D.....DW....Da....D.....D.....D.....D.....D....ME*...NE5...OE....XE....YEB...ZE....`E.6..dE.7..eE8=..fE.C..gE<3...E.....E.....ED0...ET4...E.6...E.<...E.B...E.M...E.X...E.b...E7m...E.t...E2|...Ek....E.....E.....E.....E.....E....Ef....E.....E.....E.....Ej....E....E5....E.....E....F.....F.....F.....F.....F.....F.....F.....F.....F ....Fp....F.....F.....F*....F....2F....3F....4F....5F....<F....=F....xF. ..yF$"..zFb#..{F.'..|F./..}F.0..~F12...F.3...F.;...Fs>...F.A...I^G...I.I...I.K...I.L...I.O...I.R...IuS...I$V...I#W...LKZ..)L.e..*L.p..+L.{..,L...-L....:LX...@L....AL....BL_...CL..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\app-types.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):883765
                                                                                                                                                                                                                                                      Entropy (8bit):4.863056460293922
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:ALk9CginrpJ7o7ucVkTH6kdzyrQSa0lGXOxZmMWtN:ALk9CginrcuQkdzyrQSa8YsZatN
                                                                                                                                                                                                                                                      MD5:1993ED95D64D3CD5DE371D575F252FF5
                                                                                                                                                                                                                                                      SHA1:909836744CE054B5E75FE05D90FE7C6B91013679
                                                                                                                                                                                                                                                      SHA-256:97513F97F93C87DC0F97E54F947FADADA86F894BA281803F61DDC270A9C9E87D
                                                                                                                                                                                                                                                      SHA-512:7B62DC5932B2E25D8AD617EB592D62E1013F82FD6EC511BD493395D8ABF8523AD1AB8D0E6CB899A095AB372B91275451104484207F1027FA72754319896AE00F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[{"name":"NiceJob","description":"The easiest way to get more reviews, and build your reputation. Create social media buzz, improve your SEO and win more sales.","category":"Marketing and Analytics","disallow_webview_muting":false,"url":{"urls":["https://beta.nicejob.co/"],"has_prefix":false,"allow_custom_path":false},"id":"nicejob","image_url":"https://apps.tryshiftcdn.com/nicejob/image.svg","color_image_url":"https://apps.tryshiftcdn.com/nicejob/image-color.svg","monochrome_image_url":"https://apps.tryshiftcdn.com/nicejob/image-monochrome.svg"},{"name":"Hygger","description":"Simple Product Management Software for IT Teams Based on Agile Scrum Tools: To Do Lists and Time Tracking with Kanban Board and Roadmap Planning.","category":"Project and Task Management","disallow_webview_muting":false,"url":{"urls":["https://accounts.hygger.io/login"],"has_prefix":false,"allow_custom_path":false},"id":"hygger","image_url":"https://apps.tryshiftcdn.com/hygger/image.svg","color_image_url":"https

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\assets\browser-Ah9y0qUZ.css

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1201304
                                                                                                                                                                                                                                                      Entropy (8bit):5.238163311838727
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24576:yRCxzJ4zPydo1Fy003ky1nUhc7GCVyIvZPN:Lao4sxVZF
                                                                                                                                                                                                                                                      MD5:D085DD29EB2AF9B2731AC24FA18B53D5
                                                                                                                                                                                                                                                      SHA1:37A1B0AF4C7CABD74CE0FED8A4C3A18B00B2ACCF
                                                                                                                                                                                                                                                      SHA-256:B342E9C97DA1BB505BC0D02EF67CE4DA7FA645AE36B88C50AC9E9BE9FBB68284
                                                                                                                                                                                                                                                      SHA-512:43BD954EF1695ACBF3CD4DBB3ED24666859E26A81D14E1B22AA7387AE7456A82457E3769B93DA4A20161F12867D86E55370694017A0BBDB89D788F5E0A5E71CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.icon-button{--icon-button-size-small: 24px;--icon-button-size-medium: 32px;--icon-button-size-large: 36px;--icon-button-icon-size-small: 12px;--icon-button-icon-size-medium: 16px;--icon-button-icon-size-large: 24px;--icon-button-size: var(--icon-button-size-small);--icon-button-icon-size: var(--icon-button-icon-size-small);--icon-button-background-default: var(--surface-buttons-icon-default);--icon-button-background-hover: var(--surface-buttons-icon-hover);--icon-button-background-active: var(--surface-buttons-icon-active);--icon-button-background-disabled: var(--icon-button-background-default);--icon-button-text-default: var(--text-iconbutton-default);--icon-button-text-hover: var(--text-iconbutton-hover);--icon-button-text-active: var(--text-iconbutton-active);--icon-button-text-focus: var(--text-iconbutton-default);--icon-button-text-disabled: var(--text-iconbutton-notselected);--icon-button-border-focus: var(--border-focus-secondary);--icon-button-border-focus-inner: var(--color-b

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\assets\hydrateStore-B5nfSjpd.js

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (20856)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):586195
                                                                                                                                                                                                                                                      Entropy (8bit):5.392128503870507
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12288:RGVfN19eAnHaxwBXWzhZCiFvziTKsIvx42OuipgQ3MF:geAn6xuXuZfFv+TKsIZ42O2b
                                                                                                                                                                                                                                                      MD5:C34D8FC8A8CC5C8B65AF312114BC3309
                                                                                                                                                                                                                                                      SHA1:EF4D64A98F42CF45B610BD5CFE593DAEFE039118
                                                                                                                                                                                                                                                      SHA-256:8AE335C33D6FAD3B9045A76C2AEB8AA9F5B0459C6A9C1BEEB50F6FE2C0696874
                                                                                                                                                                                                                                                      SHA-512:266DE38A596287DD01FD78C58E39334A16EBDC6AA826328C126A12680309988FEBC5F41394890B8DD8FF64E65B12BE80553F46699E72796935F31375581BE410
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var eR=Object.defineProperty;var s=(e,t)=>eR(e,"name",{value:t,configurable:!0});(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="0614e781-b20c-47c4-9815-f1422ce6875b",e._sentryDebugIdIdentifier="sentry-dbid-0614e781-b20c-47c4-9815-f1422ce6875b")}catch{}})();var tR=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};tR.SENTRY_RELEASE={id:"127.2.2"};var Gi=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function nR(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}s(nR,"getDefaultExportFromCjs");var qv={exports:{}},Ne={};/**. * @license React. * react.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this s

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\browser.js

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (39466)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):716654
                                                                                                                                                                                                                                                      Entropy (8bit):5.441664610264094
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:6144:Iyc52msJfFLqFooo3NxMmrKDXmlyP9ELbWwboHyR18rUS4JxKbuRsLh93LeAdfSM:Id5oXdmmWELDgW18rUSqRsHbes3LNt
                                                                                                                                                                                                                                                      MD5:66242C8F26ACAE1780D8946D9FAD7C74
                                                                                                                                                                                                                                                      SHA1:E69D9A6AAD0C499B81A94EA227FEE77BD26DDD55
                                                                                                                                                                                                                                                      SHA-256:822A4E50FCB441DFE0C666510C30481C165AEE1365CA93E609ACA8798D1960DD
                                                                                                                                                                                                                                                      SHA-512:39ED2708118CD93B4FFEA5D9AC7CF727CEBB60EAAF32449DDE7CB515813954786D5F2DE82B30D5F39B2C3CB44C6CCA6687BF09F487F4A971DED2EFA2000B8A00
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var xT=Object.defineProperty;var i=(e,t)=>xT(e,"name",{value:t,configurable:!0});import{r as m,g as Iu,i as he,S as Ce,a as th,C as ST,l as mo,b as ET,c as CT,d as PT,e as TT,f as Ww,h as To,E as co,L as et,z as ke,j as Hw,M as Au,k as er,s as It,m as dn,n as wt,o as kT,p as $T,R as q,q as DT,u as Vr,B as Ou,t as ft,v as MT,I as nh,w as Gw,x as IT,W as qw,y as Yw,A as AT,D as OT,F as LT,G as RT,H as jT,J as NT,K as _T,N as FT,O as BT,P as VT,Q as zT,T as UT,U as KT,V as WT,X as HT,Y as GT,Z as qT,_ as YT,$ as XT,a0 as QT,a1 as Xw,a2 as ZT,a3 as Qw,a4 as rh,a5 as Ca,a6 as JT,a7 as jc,a8 as lm,a9 as Nc,aa as gr,ab as e5,ac as t5}from"./assets/hydrateStore-B5nfSjpd.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="32c2ccef-ad3a-448f-a6d9-a27525787ee9",e._sentryDebugIdIdentifier="sentry-dbid-32c2ccef-ad3a-448f-a6d9-a27525787ee9")}catch{}})();var Zw={export

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\folder-mini.svg

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):810
                                                                                                                                                                                                                                                      Entropy (8bit):4.87373629690593
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24:tVvnjuNFZosZhjGeonhllgiLH7onhllgwq9PX5:rnBsbwLf5
                                                                                                                                                                                                                                                      MD5:CC160EFF6BF2654D893D5A04FE37BDF4
                                                                                                                                                                                                                                                      SHA1:78FA2AA60C812328416C0657398F037BA29ABC5F
                                                                                                                                                                                                                                                      SHA-256:D09077E84B52B4E74D48E2E876766A8CA2DDD73A75E5D9AEEDF813A0C6F1A90F
                                                                                                                                                                                                                                                      SHA-512:E11D0D02F65A1935CA3B3DC507A1E36FAA868F45E3C26BC34617AC0CC5BCD6FEC0FFA5277D2E78F516BBF4A60D37B59BE2E41427A9210C841F5554591026FA5D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <g clip-path="url(#clip0_5_3268)">. <path. d="M15.25 13.25V5.75C15.25 4.64543 14.3546 3.75 13.25 3.75H0.75V13.25C0.75 14.3546 1.64543 15.25 2.75 15.25H13.25C14.3546 15.25 15.25 14.3546 15.25 13.25Z". stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />. <path. d="M9.5 3.5L8.5685 1.7923C8.2181 1.14977 7.5446 0.75 6.8127 0.75H2.75C1.64543 0.75 0.75 1.64543 0.75 2.75V7". stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />. </g>. <defs>. <clipPath id="clip0_5_3268">. <rect width="16" height="16" fill="white" />. </clipPath>. </defs>.</svg>

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\index.html

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):871
                                                                                                                                                                                                                                                      Entropy (8bit):4.729698825210483
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:24:0p0JPhAAACapAtILaJwxVAEKEd7EEbFby7Ln88:0FCaNaJwoS7PFby7L
                                                                                                                                                                                                                                                      MD5:4120EE473DDF328BFD4E9895A93176F1
                                                                                                                                                                                                                                                      SHA1:CCF1DBE0AD505200E225503D6B8090C18D78BC46
                                                                                                                                                                                                                                                      SHA-256:CC1DE944BEBBF8B975482F09154DB36158FE6DF858940125D02ED03FDCF85407
                                                                                                                                                                                                                                                      SHA-512:593651CBECB2299711F071DCC2DFF792A122B4A7F856E160E5AAF5BBAD7B6F31A4ECA57E1727DF2B8A0B360482B40944FEED99B29EAC51CE562742938A97261C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<!doctype html>.<html class="light windows">. <head>. <meta charset="UTF-8" />. <title>Shift</title>. <style>. @media (prefers-color-scheme: dark) {. html {. background-color: #262626;. }. }. @media (prefers-color-scheme: light) {. html {. background-color: #d1d5db;. }. }. </style>. <script type="module" crossorigin src="/browser.js"></script>. <link rel="modulepreload" crossorigin href="/assets/hydrateStore-B5nfSjpd.js">. <link rel="stylesheet" crossorigin href="/assets/browser-Ah9y0qUZ.css">. </head>. <body>. <div id="app"></div>.. Popovers and dialogs render here -->. <div id="portal"></div>.. Window controls render here to avoid conflicts with drag regions, z-indexes or overlays -->. <div id="window-controls-portal"></div>.. </body>.</html>.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\injection\ChromeWebStore.js

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1260
                                                                                                                                                                                                                                                      Entropy (8bit):4.905458420086544
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:12:CCp02gVawR2eyYtb6Bk+CcPxzKeq3qNtb6BkSzoqNpqNKeqglVp5huLN9ZH5zGvp:m90OmzLdN0OoNINLLVp5h2NF6P3gWYLu
                                                                                                                                                                                                                                                      MD5:A1A01AAABF311B3B9D891C3C660DF20A
                                                                                                                                                                                                                                                      SHA1:2A854C6043BF4CF68A15451F9A59683650C999DF
                                                                                                                                                                                                                                                      SHA-256:5DC238C4C1BEF83B3B545A485576FD6131637017A8CFA81024BB2491A0D46D76
                                                                                                                                                                                                                                                      SHA-512:55329ED84C8B3ADD761DD599CD4C7E33B81AAEA306965F1792E38792B93948CA3F5E628DB3003E6471BCD559A441B0BDF4C031C07ACD130A6564DAF5E829362B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:const CHROME_ADD_BUTTON_TEXT = 'Add to Chrome'.const CHROME_REMOVE_BUTTON_TEXT = 'Remove from Chrome'.const SHIFT_ADD_BUTTON_TEXT = 'Add to Shift'.const SHIFT_REMOVE_BUTTON_TEXT = 'Remove from Shift'..class ChromeWebStore {. constructor() {. this.start(). }.. overwriteExtensionButtonText() {. const addButtonElement = Array.from(document.querySelectorAll('span')).find(. element => element.innerText === CHROME_ADD_BUTTON_TEXT. ). if (addButtonElement) addButtonElement.innerText = SHIFT_ADD_BUTTON_TEXT.. const removeButtonElement = Array.from(document.querySelectorAll('span')).find(. element => element.innerText === CHROME_REMOVE_BUTTON_TEXT. ).. if (removeButtonElement) removeButtonElement.innerText = SHIFT_REMOVE_BUTTON_TEXT. }.. start() {. try {. // ensure the script runs on initial load in case there are no further DOM changes. this.overwriteExtensionButtonText(). const observer = new MutationObserver(this.overwriteExtensionButtonT

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\injection\IntegratedAppStorage.js

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2000
                                                                                                                                                                                                                                                      Entropy (8bit):4.6455778594096095
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:48:bGoZ1QYiBVRjEY8dprJiXyEYqWTxWmYjaSJGYD:ioQnR/ApAXycWFeJH
                                                                                                                                                                                                                                                      MD5:6AF8E7B58FDB30696F3F789DA4B0E8BE
                                                                                                                                                                                                                                                      SHA1:D2701AC9F1DD8CE656E49F6C56805A3CA569DEB6
                                                                                                                                                                                                                                                      SHA-256:F021CEC789124F8EEEC820CCB59E81F376D161ADE960F9978C887E9B57E4141B
                                                                                                                                                                                                                                                      SHA-512:71990B196BE64BBF95D3FA32FD48B1896DB2329AD983EC3049C9D48510D01D6CCEEAC658C7DB1F69E5A74BC2D3AE744462B38A3CC759670AA959759C1C34EA26
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:const SYNC_STORAGE_KEY = 'sync.'..class IntegratedAppStorage {. constructor({ webUiAppData }) {. this.webUiAppData = webUiAppData. this.start(). }.. start() {. try {. // Listen for changes from the app's local storage and update the Web UI storage. window.addEventListener('storage:local-change', event => {. const { detail } = event.. if (!detail.key.startsWith(SYNC_STORAGE_KEY)) return.. chrome.runtime.sendMessage({. channel: 'integrated-app-storage',. body: { storageItem: detail }. }). }).. const isWebUiDataEmpty = Object.keys(this.webUiAppData).length === 0. const syncLocalStorage = Object.entries(window.localStorage).filter(([key]) =>. key.startsWith(SYNC_STORAGE_KEY). ). const isSyncLocalStorageEmpty = syncLocalStorage.length === 0.. // Pull the app's sync local storage into the Web UI storage if needed for the first time. if (isWebUiDataEmpty && !isSyncLocalStorageEmpty) {

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\injection\UnreadObserver.js

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4593
                                                                                                                                                                                                                                                      Entropy (8bit):4.626012712312796
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:PynetRFPV8vWuDF0/1a+YGgZt18wcv2/IOianVKyqCMxdTSgt:v70WG+DSghv2/InanVKPRxdTpt
                                                                                                                                                                                                                                                      MD5:3025E0D58F9989AA4E9A8D7ED6198AC1
                                                                                                                                                                                                                                                      SHA1:96E67E2727C6CF503E2B41EED246453E7CDAB4A5
                                                                                                                                                                                                                                                      SHA-256:322C716660C5ED09DC93EF5C9EADA1C4D6DBDDB2AB07A9964DF31477581DAB37
                                                                                                                                                                                                                                                      SHA-512:2061A46EC43D235986D29317981EBA3E6C6B9E3B8070FEEA9A05584B25516084F7425720FC66ABEFA41D450466BB436200F506B4DD576B00A3987BA24152E4ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:class UnreadObserver {. UPDATE_DELAY_MS = 500 // 0.5s. SETUP_INTERVAL_MS = 30 * 1000 // 30s.. constructor({ config, extractorFunction }) {. this.config = config. this.extractorFunction = extractorFunction. this.countTimeout = null. this.lastUnread = null. this.observedNodes = new WeakSet().. if (!config) {. throw new Error('Cannot observe unread count without an extractor config'). }.. this.start(). }.. start() {. // Don't run in iframes. if (window.parent !== window) return.. // Setup observer now, again on-load, and periodically thereafter. this.setupObserver(). window.addEventListener('load', () => this.setupObserver()). setInterval(() => this.setupObserver(), this.SETUP_INTERVAL_MS). }.. setupObserver() {. // Find the node to observe for mutations. const node = document.querySelector(this.config.observerSelector).. if (!node) return.. // If the observer is already setup on this node, nothing to do. if (this.observ

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\service-worker.js

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (4329)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4373
                                                                                                                                                                                                                                                      Entropy (8bit):5.235422676792197
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:ObWx4edq1WHYv44KzWp3SifJmYJ/EIsf4rZlPL83joLy7Ak:ObWuedMjv4jzDiflNi4rZBL4joW7z
                                                                                                                                                                                                                                                      MD5:601C1EFF9ABC29CE38C0B2A02F1A657A
                                                                                                                                                                                                                                                      SHA1:4840B62068F82A2855285C78C25D518321A000A9
                                                                                                                                                                                                                                                      SHA-256:CF43C96DE9B51F42003ECF06E33CFEA82A8C2931284DE342C5DA2EFF33131BD6
                                                                                                                                                                                                                                                      SHA-512:BAAD15808E2976ED4CCCC70D1E9CA91A7560DAADD031BAE996FDEE3DA5E2FFB8CDD4E79C344DA3FE0192702D338D6C254593C90854BED341B4FAEE522BBCA455
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var S=Object.defineProperty;var s=(e,t)=>S(e,"name",{value:t,configurable:!0});import{h as u,L as d,z as v,t as y,i as c,S as T,ad as P,k as b,s as _,m as N,M as C,a5 as F,b as D,c as E,d as x,e as R,ac as j,ae as h}from"./assets/hydrateStore-B5nfSjpd.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="a119aef1-cc54-4d64-9aa3-5e8adeafa954",e._sentryDebugIdIdentifier="sentry-dbid-a119aef1-cc54-4d64-9aa3-5e8adeafa954")}catch{}})();const k=1e4,I="normal";function m(){const e=u(),t=new d(m);return new Promise((r,i)=>{let n=!1,o;const p=s(a=>{clearTimeout(o),n||(n=!0,r(a))},"clearResolve"),f=s(a=>{clearTimeout(o),n||(n=!0,i(a))},"clearReject"),l=s(a=>{a.type===I&&(e.windows.onCreated.removeListener(l),p(a))},"onWindowCreated");e.windows.onCreated.addListener(l),e.windows.getAll({windowTypes:[I]},a=>{if(a.length>0){const[w]=a;if(!w){f(new Error("No window foun

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\resources\wexond\shift-logo.svg

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4386
                                                                                                                                                                                                                                                      Entropy (8bit):5.022016088254076
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:96:SOlbgFY0za6CFHelna6R6pdpt17Cr+ygYQ/hO72hJxhi:5bSY0za6m/6R6prTCCVldhi
                                                                                                                                                                                                                                                      MD5:086C9D8C73DAD20C8E0CEABDC893C309
                                                                                                                                                                                                                                                      SHA1:A7E3BAE94800E43C4AC6763029FC77DF2BA114D0
                                                                                                                                                                                                                                                      SHA-256:1910F0F4ACFE551CFCF6924D57B150538905073AF612C8946C00A78A3C8ADCC7
                                                                                                                                                                                                                                                      SHA-512:DC3B428A0B1E0804910371D3BE0469CC79FBE1A05F3D9DFE58F6F8491D2E1D6EADC7D63CA97E10FA164ADC7BF64F2DD5F52346F551A3E750017C2D0FC8536FCE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<svg xmlns:xlink="http://www.w3.org/1999/xlink" width="32" height="32" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M74.9775 74.9775C-24.9925 174.948 -24.9925 337.038 74.9775 437.018C174.948 536.988 337.037 536.988 437.017 437.018L74.9775 74.9775Z" fill="url(#paint0_linear_318_13)"/>.<path d="M437.018 74.9775C337.048 -24.9925 174.958 -24.9925 74.9775 74.9775L437.018 437.017C536.988 337.047 536.988 174.958 437.018 74.9775Z" fill="url(#paint1_linear_318_13)"/>.<path d="M437.018 437.018C487.008 387.028 487.008 305.988 437.018 255.998L346.508 165.488C337.718 156.698 327.968 149.468 317.598 143.768C308.508 138.778 298.948 134.968 289.138 132.348C246.438 120.948 198.988 131.988 165.488 165.488L346.508 346.508C381.448 381.448 383.828 436.598 353.668 474.298C351.458 477.068 349.068 479.738 346.508 482.308C338.578 490.238 329.608 496.478 320.038 501.058C311.828 504.978 303.188 507.678 294.378 509.138C303.868 507.708 313.178 505.758 322.298 503.318C366.348 491.5

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\Shift-bin\127.2.2.1372\shift.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):267541360
                                                                                                                                                                                                                                                      Entropy (8bit):6.591411967121428
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:1572864:fF4S/KaZ4qQsnS2/TPWGjrmWWWTnQVADH3WM5CvJwhdAHUzXa/:f7KUJS2/ScqEjM+uYu
                                                                                                                                                                                                                                                      MD5:3730C7DC8E32714DB9A0F815E1E0AC68
                                                                                                                                                                                                                                                      SHA1:25F2E79A4F7DF011B0D0E07D36BAA33C52CBA78C
                                                                                                                                                                                                                                                      SHA-256:055C32B0CB0394E6B4BA4A658A4820CD7946414D331261EA47BAFED67216F81E
                                                                                                                                                                                                                                                      SHA-512:AB932165F2BA2E8591C74BDFA56E1C1093D600485B09E623921EB43927B6550116FB658799E31882A74D15495C31804A967EFC6AC6127CC6E506B7E39B18D432
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........." .........&.......%.......................................@......p.....`A........................................$.......0...h.......8....P...cA..B..p.......t.....v.8.....................v.(....#..@...........X....... /.......................text............................... ..`.rdata............................@..@.data...h........n...p..............@....pdata...cA..P...dA................@..@.gxfg...0C.......D...B..............@..@.retplne.................................rodata...... ...................... ..`.tls.........@......................@...CPADinfo8....P......................@...LZMADEC......`...................... ..`_RDATA..\...........................@..@malloc_hR........................... ..`prot................................@..@.rsrc...8...........................@..@.reloc..t...........................@..B................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\Temp\source3888_1437451139\chrome.7z

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):378663861
                                                                                                                                                                                                                                                      Entropy (8bit):6.816341965354311
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1B437F91911CE00511EA84A61BD941BE
                                                                                                                                                                                                                                                      SHA1:97DCC635AE3E27EF8DD27F09337549CBF32A64B6
                                                                                                                                                                                                                                                      SHA-256:D09D4F854D77BFFC33B64C4EA9755D104A66F9164F03289F17C73C7BDE02E121
                                                                                                                                                                                                                                                      SHA-512:84EDD4CF7F761F86FF26EC83A0986E582261BD88FE59679C4ACA406EC1E59A41F6B6B7F99A2E22D53713133EA07A4D5700A70EE158785EFD0232EECC04B2D9FB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:7z..'.....>o......&.........u.<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='127.2.2.1372'.. version='127.2.2.1372'.. type='win32'/>.. <file name='shift_elf.dll'/>..</assembly>..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...;............." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\0a87b92e-6278-4e8d-9cf9-ce3102e06747.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):976
                                                                                                                                                                                                                                                      Entropy (8bit):5.659853420035044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E369648C22B1A0BA78B31EDE5D1872E
                                                                                                                                                                                                                                                      SHA1:CC7126E326D4DC3BED31F7C41E1D8F4D86E566EB
                                                                                                                                                                                                                                                      SHA-256:61C4E0878AFC8608E19E853C5DB62CB250D805A0E73E6BAB0B12DAB5C32CF2E6
                                                                                                                                                                                                                                                      SHA-512:967E7692689FA7A74188711E369E51792036FCC036B8620AA77638ACD0BCCE20AEA459A53071A272E5137444A86D52B602F1CC447E3C037243F1CCDBAF4A5231
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{},"profile_counts_reported":"13374268045565482","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1729794445"},"user_experience_metrics":{"low_entropy_source3":4647,"pseudo_low_entropy_source":2561,"stability":{"browser_last_live_timestamp":"13374268045483057","stats_buildtime":"1708978522","stats_version":"122.0.6261.95-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"16"}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\360dea1d-ddaa-4cd1-9cda-c1845c59e171.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5730
                                                                                                                                                                                                                                                      Entropy (8bit):5.306416859453248
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7FBB9F605C89C6CAE2229799460ADA54
                                                                                                                                                                                                                                                      SHA1:55976D6415B02E08AD4F0FAA94880F9F78E07787
                                                                                                                                                                                                                                                      SHA-256:5F4C7F7EDEAF9B35F983D95A315E55BCE50560C0068E4BDBD841A6B7017FEFAB
                                                                                                                                                                                                                                                      SHA-512:C756DA00003CDCFCF00A05179C8F74A2F19E7CD208FAD510357546ADDA5E66A6EDB9074942E7BFA783D8B225B01BA8E44D0A13B7D43CC21EB98AA52849EE2A05
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"breadcrumbs":{"enabled":false,"enabled_time":"13374268045737222"},"browser":{"first_run_finished":true,"shortcut_migration_version":"122.0.6261.95"},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"policy":{"last_statistics_update":"13374268045736406"},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{"Default":{"active_time":1729794447.483303,"avatar_icon":"chrome://theme/ID

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\3944c2de-1e45-46e1-b8ce-40d6009a8213.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2498
                                                                                                                                                                                                                                                      Entropy (8bit):5.335461432874067
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1194E1EF1C2D505D91D99541AC251CE2
                                                                                                                                                                                                                                                      SHA1:2BE14C7F04EE2AEBD1DE41D5C02F7AB557ED42D4
                                                                                                                                                                                                                                                      SHA-256:EAB2E813ED2A0EBA821CA500EB51BCAECBD83446D39CDD65FAC69FE694CA3C20
                                                                                                                                                                                                                                                      SHA-512:4D46EFEF1A43EBCCDD4954F94618DB7A31CCE31F1EA2223D1832BC76865D17F40C7A5AC595FBC963002EF3700E861F909E2E61EB2428D2D29E0A698F690649BA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"breadcrumbs":{"enabled":false,"enabled_time":"13374268045737222"},"browser":{"first_run_finished":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"policy":{"last_statistics_update":"13374268045736406"},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{"Default":{"active_time":1729794447.483303,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_26","background_apps":true,"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\BrowserMetrics-spare.pma (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4194304
                                                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                                                                                      SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                                                                                      SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                                                                                      SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\BrowserMetrics-spare.pma.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4194304
                                                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                                                                                                      SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                                                                                                      SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                                                                                                      SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\BrowserMetrics\BrowserMetrics-671A918D-23E0.pma

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4194304
                                                                                                                                                                                                                                                      Entropy (8bit):0.50661886047614
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9AA77302B43F345C236B29D46C750A4C
                                                                                                                                                                                                                                                      SHA1:40CB5CF6E33B84AA3B493BDF5C46DF7B391D0D2D
                                                                                                                                                                                                                                                      SHA-256:CF50286FBAB8C43B590AE12397F3F5E5402E655E61C880A179131F36811435D4
                                                                                                                                                                                                                                                      SHA-512:B7485D003C96F95B55DDEFF1E197C02214E5B4B07C8B85670AA485B5A8F6EA3015DE34FEA006A93453B54F6DB3F6B0C64717BB101B9D83BB469EA251666423FB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...@..@...@.....C.].....@................T...T..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............122.0.6261.95-64-devel".en-US*...Windows NT..10.0.1904224..x86_64..|........".To Be Filled By O.E.M....x86_64J...H4....J?J........J?J....r...J?J..SYf&.vN&.J........J?J..m#:^...YJ..;.....J?J..RS.....J?J..:.Y....J?J...!.....J?P....$..................$.. .......NoPreReadMainDll....Enabled..<..8.......NoAppCompatClearInChildren......Disabled_20231128...............WebGPU......Enabled..<..8.......DefaultGpuDiskCacheSize.....max_cache_6M_20230913....4..0... ...MediaFoundationD3D11VideoCapture....Enabled..(..$.......ZstdContentEncoding.....Enabled..8..4.......DIPSStatefulBounceEnforcement.......Enabled_v0...P..L.......IPProtectionPhase0..0...enabled_proxy_a_ip_protection_phase_

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):40
                                                                                                                                                                                                                                                      Entropy (8bit):3.3454618442383204
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:24DF7EC20BC94CABCFA8E8944F036437
                                                                                                                                                                                                                                                      SHA1:49B285D435623013FEFA589A707718236945882E
                                                                                                                                                                                                                                                      SHA-256:75171BAF5290CFD0891BC381F403DE7A077074B8F2712B63CD76ADB1CE27B496
                                                                                                                                                                                                                                                      SHA-512:9F46D50B7A62AB018FAB0DC350DE967AD005A067F05686D54573594A46A93B5FDB141878C07C5847288D9943387F08BA4B01DBBD0313527371D660AEDEBC884C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:sdPC......................~.7+EK...n.Z7.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\0a6326c1-c710-401b-bb67-19730eed8207.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6742
                                                                                                                                                                                                                                                      Entropy (8bit):4.929544861313013
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D7660EBFE3B80D3E71E37B13C4782C26
                                                                                                                                                                                                                                                      SHA1:D7CC0FA23237B1A55BCC4D4F90651B9A65C27EBC
                                                                                                                                                                                                                                                      SHA-256:A43FEBBBF17E050831B1316369621F21FF16438BCD68C507750BED2A6853EB8C
                                                                                                                                                                                                                                                      SHA-512:B28E8CA90889C54C448AF1E57D320106EF8D33E88DE791FF7D0A73E5A132A1F7B57A7662C37CB0FA092906474E0DA2DDD3455245CBCD22E23DBB99362ED3DEAE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":false,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\18a2871b-d3ff-4248-86b0-b334ebdec5f5.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):414
                                                                                                                                                                                                                                                      Entropy (8bit):5.060721767030579
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E180CF47DC9F89444361B500B1932F47
                                                                                                                                                                                                                                                      SHA1:E1362BF0D7F9FCD323C53A0050432C758EF118F9
                                                                                                                                                                                                                                                      SHA-256:E82CD87BC73040F6B3E8C7C0FE156597B58A3ED788D8F3C24F3BC11CE66531C7
                                                                                                                                                                                                                                                      SHA-512:931FBBEF6AA76C43088769B1F4FB8EE8F4C28C9A757AD0305D77B46458FDC19231DFEAF078A7B3ABD0E75984AF387716E1EC9190C095AE70C9B1A8892F2BD77E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{.. "epochs": [ {.. "calculation_time": "13374268066312217",.. "config_version": 0,.. "model_version": "0",.. "padded_top_topics_start_index": 0,.. "taxonomy_version": 0,.. "top_topics_and_observing_domains": [ ].. } ],.. "hex_encoded_hmac_key": "E7C998FE2307C7EDD7AE6564A8397EE6FB9734E80B0B7B3092E4CEDA4E207AA5",.. "next_scheduled_calculation_time": "13374872866312464"..}..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\2fd8da01-c7d2-48a2-8d82-550350b1cfcb.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6569
                                                                                                                                                                                                                                                      Entropy (8bit):4.923810802743414
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:287DAF312DBF5EBC9B2E4A7FADDEC864
                                                                                                                                                                                                                                                      SHA1:A21397D718E421F837BEF1DB1F4CDFEA9CA71DC3
                                                                                                                                                                                                                                                      SHA-256:AFD0A7D644DC8F3E08413117A6DEEB44D61ED6FFCF379F62F246FC8ADCA23764
                                                                                                                                                                                                                                                      SHA-512:2D87AC6B2E73023710966D14EA0DCBDC24A34A7294882E4E6F16302F7829A8D6E9ED4D0FB1088D7666392136266AD026FA339079BE2FC96E9B1D35131AD2D331
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":false,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\7a05de4d-c222-4536-a067-ee58ed61838a.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6960
                                                                                                                                                                                                                                                      Entropy (8bit):5.609195468095631
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:31988C99DD137D239665BEE4FFD3461C
                                                                                                                                                                                                                                                      SHA1:BE22A02AA457FDEE634FC61A8594CFBF8BD54076
                                                                                                                                                                                                                                                      SHA-256:F202F18AD9633CA0D1D3A1D4393D0A9AFB845058D68C541C39A6F01D75DF4468
                                                                                                                                                                                                                                                      SHA-512:0858FDF24351567094E80803611878534A8571481F9C2A65CB2D09F164C34E371EA299A7A5DF86AD74EC6AAA9E0D374D8948FCB006509D00C038610A44B2F7F0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374268045883601","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374268045883601","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Shift.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpG

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\7af245fe-c6a1-4836-85e5-423cc7807e9f.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6801
                                                                                                                                                                                                                                                      Entropy (8bit):4.929934460376421
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0F9769201E7EF5BB03FC3DC5D0BE1734
                                                                                                                                                                                                                                                      SHA1:250A915F13830C3329651E03BFA8C899229D7A58
                                                                                                                                                                                                                                                      SHA-256:73D03C4CEA33E43C028570E4F4099DEA35A30B1C284A3D370B97A1C6336799B9
                                                                                                                                                                                                                                                      SHA-512:BAAF22A61C335CDB6A2B9774CCB9FA85C151B0CBE5E8C0B3075A5FDEA97A95220DAC71FF2EEC448621CF5BF55F41D5255815571207DF9C371EA2C4651B9CB140
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":false,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\7f620a9c-9430-4e5f-8cff-213824eb752f.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:very short file (no magic)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1
                                                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                                                                                                      SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                                                                                                      SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                                                                                                      SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\9eda18b2-db75-4139-b809-b3ca27588020.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6170
                                                                                                                                                                                                                                                      Entropy (8bit):4.9046501507448745
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:485EB5F3A7350D6AB274B5BDAD34DD76
                                                                                                                                                                                                                                                      SHA1:B2BA5E50D2121037F96797FC1D22C4E2E561A49A
                                                                                                                                                                                                                                                      SHA-256:3BED34434260F1AA9C860AFD136E1DE7B26CDEFAD1206FED5EBC8F6E19A82D1B
                                                                                                                                                                                                                                                      SHA-512:F6A1425475CF5A6E2EF3FF0F79F90172668C583BD9B177F9C669A3F59993F3E99C2D2136E51E6243A64EBBBF808A73266588E3D5FC11EB7D866590B0C955AD4C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Affiliation Database

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 5, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):53248
                                                                                                                                                                                                                                                      Entropy (8bit):0.39883547114174095
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:ABD5F8EA3D9A79D25AD874145769B9FD
                                                                                                                                                                                                                                                      SHA1:0E5CB55791194D802B3D3983BE3A34D364D7A78D
                                                                                                                                                                                                                                                      SHA-256:50E624AB71E65F7BFF466E9066621F0EE85E87F74EACD85F1952433294E1C5FD
                                                                                                                                                                                                                                                      SHA-512:19126380F34E2A2517FDA41CB1B824B4A0FB467B60126120DEAB669288FC3E851DA481655DC1887F17762B6394957C4BEE882DC233F7564433E25D947C80E66B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....e...$.y.........H....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\BrowsingTopicsSiteData

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):28672
                                                                                                                                                                                                                                                      Entropy (8bit):0.43779463510657946
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2FC3609B37500F785639AE7217B67A67
                                                                                                                                                                                                                                                      SHA1:F63D3B9B2E8EB98177742EBBCCF2A18A64DF33B3
                                                                                                                                                                                                                                                      SHA-256:FAE90E262589B5B22A1CD522972F9DE32E9B0EE1A2DF42AAA411437E5A49D753
                                                                                                                                                                                                                                                      SHA-512:508FDFCA95103F4213999EEBE20C5D82BEDFB01F01129538BFA7394556CA67B528322F662BF3128CA87E3AC0F0F58FB42345ACDA49AB67BA1D763084CF5AB05B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.......o..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\BrowsingTopicsState (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):414
                                                                                                                                                                                                                                                      Entropy (8bit):5.060721767030579
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E180CF47DC9F89444361B500B1932F47
                                                                                                                                                                                                                                                      SHA1:E1362BF0D7F9FCD323C53A0050432C758EF118F9
                                                                                                                                                                                                                                                      SHA-256:E82CD87BC73040F6B3E8C7C0FE156597B58A3ED788D8F3C24F3BC11CE66531C7
                                                                                                                                                                                                                                                      SHA-512:931FBBEF6AA76C43088769B1F4FB8EE8F4C28C9A757AD0305D77B46458FDC19231DFEAF078A7B3ABD0E75984AF387716E1EC9190C095AE70C9B1A8892F2BD77E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{.. "epochs": [ {.. "calculation_time": "13374268066312217",.. "config_version": 0,.. "model_version": "0",.. "padded_top_topics_start_index": 0,.. "taxonomy_version": 0,.. "top_topics_and_observing_domains": [ ].. } ],.. "hex_encoded_hmac_key": "E7C998FE2307C7EDD7AE6564A8397EE6FB9734E80B0B7B3092E4CEDA4E207AA5",.. "next_scheduled_calculation_time": "13374872866312464"..}..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.3439903367741672
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9D26BD4BC9420AD1C8294671B67F3515
                                                                                                                                                                                                                                                      SHA1:6609F64AAA1334C21510A0E898A10E248D8995CC
                                                                                                                                                                                                                                                      SHA-256:9183E056B17D8D3D51D8ECBC414E307487FB4AD70A997323B96466D550B045BD
                                                                                                                                                                                                                                                      SHA-512:616DD8C0E0C2FA6B4DCCDAF6015BE7DD35ADE3BEB5B27E6C0C77BBF2D827A447604F55D113FE6017839B9F512920520EE440CCBAF280DD645873E2C0B5A53211
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...0.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):0.5596905498382284
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A57DA3201E2E45381B93BBECC375C8D1
                                                                                                                                                                                                                                                      SHA1:D8B9F41DB83F4B3297E67C667BEA98EA62108CAA
                                                                                                                                                                                                                                                      SHA-256:E469D361D9B9EEEF2ED4844D1E3A6FE8245BBFD2F48CF21E9FCD4019EDD745F3
                                                                                                                                                                                                                                                      SHA-512:A54FC8A88C4A265878E0331A4BD69A92AE9A9658CAE4F8DE3536F0820BF8FFB8D08D32E33A67A0A606250C27375CE5ECA27E06D5CD3960F2C0ADDD0549BF8FF8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:................A.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1056768
                                                                                                                                                                                                                                                      Entropy (8bit):1.3666976885386284
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:17FA811CE0DC53F4151775C57CF5B0E0
                                                                                                                                                                                                                                                      SHA1:FECB223483EF8024AD08040F9E59EF06E85FA56C
                                                                                                                                                                                                                                                      SHA-256:9DB2A4A636A188ABFD236688384039DC14F993EC4BE99FB9BB607D8C8DBAC21C
                                                                                                                                                                                                                                                      SHA-512:F7B980DA63FDFB95E0E646AA62858BEF570326467DAE58DD9A682DEF9BC4B6E19F24DE45BDD6CC5E571494A67FFDF0AA8017A107CCFB051FA3EB0F19F2F39418
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.................................................................................wwww.p.w....wwwww......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4202496
                                                                                                                                                                                                                                                      Entropy (8bit):0.22998194560050797
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D847D20EBE033A67D2480178DD330804
                                                                                                                                                                                                                                                      SHA1:D3A43050DED4582C59EAD6A60FF5BA60A55D45EE
                                                                                                                                                                                                                                                      SHA-256:A7E8551F2656E974BC988BD6B835B3956B2F90E698E1FD0365D4E6D653894551
                                                                                                                                                                                                                                                      SHA-512:082CD11E407EAB58CF445D668E9EC10162B69A38253E82041114FAB0F249F96F15B400B95F364359AF9E8B15928ADE29907D78E5EFE979400CE659445FD85474
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):36712
                                                                                                                                                                                                                                                      Entropy (8bit):7.992101227097579
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CED23C48B5B61CAA771600F27FF637DE
                                                                                                                                                                                                                                                      SHA1:A8E3902FCDF3E42DBF2C1F51C29FAE0E560C73BF
                                                                                                                                                                                                                                                      SHA-256:1D0B903A8FC844A04CD3887E295B6B46C158D8B0B9513B8ED5CA87B7C5DEE873
                                                                                                                                                                                                                                                      SHA-512:84131A46DFBAB4E9A4E7A4B6C39CA37F8AD47EBEB34ACB8F810A40144B8399B5C44AAFDFC49B7028BD7B735B7CB7E03BED55201F0E4EFC6D0CC0BACEF0B854D1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:S.x5..I..Cf.mZ.....@.I=..H]...........&..j.;........_.}.*v..L...C]N.....@O.b.X!.aX.^....?_u..<Uu.9Y.....Y....M4H @H.F......\m........Y-..FUe.f.l1..h.|...f... I..TR.s..Az)......j..A......*....S..(.....@Yb{....v.=yuy.A.@A.A......w...@....n...iF..r.3.....3s...H......^w.z..,......e..".t....i....My..D....fo#ffO..3c<........_..g.:13d.J..;.....>.?8Lr.............1. _.z.'....mk.5x...a....L..S.D....l.u`C..%.p..Fe.S...w.. .9..[.T...~.B..x..c.z.@6...2..@W.".......bt:........!~5.q.9.aY.`.}4...`...b2f..v..$.P\T..?C.p.u.v...(..;.a+.J...$..5E.../c.eD:G.v1." 5^....>..+\+N..".2.}....TQ...A........l.,...$.......A..=.....-.y.oo..E.8}z.T..S......s.1....f...I...>....1..xc...;[.>.^..m.G]...^......a.............L...S...[......QW....g.a.x._.....d.(}......}).....^.L^.`....8.....~.1|.5<./8.......S....xp.G=T.:...)s......4.s9.`.y....!\.......|.w.y......-..D...^3}...+o....&.*o.]cX....G.8.!....=_W.9.0..}.8ZHg.-...-...b....?.z.x.!......~.C...a.M*..a..oc0},....G...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000002

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):224602
                                                                                                                                                                                                                                                      Entropy (8bit):7.998653451265082
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E57CF0614F04F25A992137EEB29AC0DF
                                                                                                                                                                                                                                                      SHA1:E8B8BEE602AE91167798222F92EF1B284EC92612
                                                                                                                                                                                                                                                      SHA-256:96A1BBF3EEB8C4EE6394E3650616B28396E81BDB0921C9EE8A6022AAE96F01B9
                                                                                                                                                                                                                                                      SHA-512:B23D6A06FFA3A46B870A11B8B79C8A9067C7B7ABC32D7E3B75E51BFFF03D0BF699DB50D267BC97C1FDC944F7B7FD713BAB953402FB3C7A2379103ACD2CCC2557
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...rh...q..p.............'........pS.?...o..........pL....F..b...N..........?.?.........hMV\Hg.gDW|)I..H.....+l....d.....c...[2.3{.K..m.}..0)6.L.6.6-..".....!..._t.....X...r.$.0P8.mK;:.......[ND..e.........7.2Vw88}..j.b..G.5..%.Q..1........4.......d..>.].L..o2].:..+.........j..z..$.Q1@.,.(._/ ..."o..._....E.T..7..gg;)..8..(..MuZh..@.K.......OF..[...M$%.IJg.+..V"K...8.....1...I.X.g...z.h.I..6..7QSFj..z.*.9...$...(+l.V..d.`......k.....B.~+{\6.{.L...<..7..YYF.0..`T.0..0....r2..".m......$.l......V..F,...9=F?.v..@s..y_...!.5<!...i.e.....W9Ubw.q.c1.D......p:.'....g...<.....H1.I....8.=...(U-P. .1.....W.6>..l..W....7^A8.....M.|.d.P..O...[).s.}....?3..H......FB.I..{.H.....L.k...^....Y5= ..K.{%@..j.-VIk.5.....J:&......k...ni.h...c.*......i..C...5NTD.......m_.+j.5..0..24.c.., .a.2.c........HD.]...W.R....m(i?...{`....\.W.s_.$m.....!X..&cVw_....B2.v.1.L.^..`.]Pib|..~.........Y.e..lQ..[1.r..d2,CK..%i.c..`..G..C..^.L....1f..h<.1...ZO.!.....h1...~.a.....f.dL..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000003

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33049
                                                                                                                                                                                                                                                      Entropy (8bit):7.993802092550734
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2A111735B06C8C4ECDBA83C29BD2D7DE
                                                                                                                                                                                                                                                      SHA1:8722CF85607AB1B1A27AD19A8A42B9AF791B00F8
                                                                                                                                                                                                                                                      SHA-256:F1E6F805B4FF58FB2FD78C211F17EF8BF76C25DB6B8C8D826A6C837252C0C980
                                                                                                                                                                                                                                                      SHA-512:0DFF11F4ADE6EF95DE644DBF44B25481F92A157557B98A161FA010F7B531CBDD9905DCAB62EE1F016ADB427EBF28A5F13BFE2F6B2EBDF6A3CFAE90E116DE218D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:S|x.Q..."*{?.)..'.v..........q...i............ql.6.I6.QR...z=....$~...dUI-.a.`.o.o..f.......3.B.eY._2.....8......(....4......d.p".b.Q..X.*.s....+......1t.iJ..}.................$.2..c].c...i&...C.L.d#.oo..QQZ.O.q2x...##rl....Y...7".U..WR....-3...d1(..Hp....oV..%..2qU.1......1........N..5h..z..U...""(.gch....EB....n.o.u..XWg.%@...?...Z...t,..$...X....?Zmgf%....KP.oc....]'.2.. .:}..e.+'.][W.o...px.:m....6...........D.....*.W......\.R.VU.....q.>....|....|..r...;.R....k........C..:...........).R.Z..K"..os.k..}.\...>.?...|...>..aNy..........).?./.7o.R...jz=.......|.o..#...................k.....S...W.o"...{..\?..u.:...Lm.F{].g..S......9.[^.....=.._>.g...7.7.......H.NzD..?<..s......cx.G.h...[.gv.;...Sax..\._ohv.....5..{.(......<f_..<.#..P...Nv....U.sx..P.-.]F..<..eT/w...8.....:.]{W.,.lc..%......'k)%.v;J...".....c...g\.^B..hQ,...)7c\)|.._....Py..4b...h.X..2.#".c.<....E\.Z.....1.!.Ih&.W..1!QO9W|..q..o: ....]....>.S$.j.$.../..7..%..V..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000004

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33928
                                                                                                                                                                                                                                                      Entropy (8bit):7.993890110004009
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F0F40B8BE94A3B335423F77E5AB02B1D
                                                                                                                                                                                                                                                      SHA1:23B429C824B622EEF1B2A0A66CAA2B9964AB3CFD
                                                                                                                                                                                                                                                      SHA-256:EDA897DEFF9DFE594BB7807740B1DDF3EA4D28237727A29B5E317B426BEBD399
                                                                                                                                                                                                                                                      SHA-512:D2C9A0FDD760BD0070FAF52C77F960E44690FBEAB7F314591A9AA48F2E4D00EBC50C6397F28CD5F9FEC801FF085C49B5C2A9FBAFCB0660B6D1A4C406FDB2C9A2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:S..Q..."*{?.. z.j...HY8..)0.w.@........Q-..%....f7..!J*........nx....1)jIV......|.x.p7[..._N.....$..Y...G..0-...u.P....i.i....O..'..*...%...`G.A.~.p..v.3......9..{....a.(.E.a...4$....q..c.Y...kbE.$..Ur .|6.d#.......)..r-f...e....$..r.T........r.x..4.Q.)L..."...]]oW..%..2qUM..yv....d.QL.KZ.C....cE..l.124m3.d...Q.....7{....e...-K.u...N...{$..._..........!.0...ncV...|....!.3.YR.I...$....,W|.,."0..s.#..Z~..>..zm7.....!...O....WzV....n............&.ZjV+.wI...m.u-.o..#.y....._..;.1.)o...-......9..'....].5`.I..?..?5..mD.'.c,...:.m.i..._...............|.rJ..4.*<.|........q`<.<.....i.3.....?..m.u.........k..f~...M+D.@.Y.fx6Z.FV.g...3.e...nCH...9.h..[N..exf...?oU...3..r.|S..ex.F+G..G*yzx...M...vxv....><....Y....?.g....;e...w.....S{..{...X.m{O.<mMc..#...(GB.....;.(......{...4.sy........."...SnZ.R.~......y...e..rk.`.I........%..q`.1F...I..!>+..c.b.....^.K.D=.T.F.@.r..H.W..]....>.S$.j.I..j...G.. .......B .F..g.v..~.>[.....A. ..H|.Np.&.uZ...Qwq[;I.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000005

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):32493
                                                                                                                                                                                                                                                      Entropy (8bit):7.9911313016343986
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:DC428CE451FE6CDAFE75C93DAF89A09A
                                                                                                                                                                                                                                                      SHA1:C135A662611D57EA982568D791C475B0D90A07AC
                                                                                                                                                                                                                                                      SHA-256:259BF6445F654692537886759B465923BC699936519B4F0E94F4486213E87C69
                                                                                                                                                                                                                                                      SHA-512:49BE622036552D58C0A2E5DC222281FD7C06BA114BDB84A5437300D1FA5C1A53D42ECAC340D500CED67305464C64D971D4F424A7C5216F189C7E895F502372DA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....(*.=.....@#e...3p\.u.......k2..n...EQNU.n.;\..j;I.N.C1i..hS......=.....w..Z_....p..ON./)..')O.......7x.o).k.R.B...4?.Vk...9vdG..n}.K.(......T.....qa..%(...f....SU.f.`....?...1H....4c6%. ..l)`wk.-s.....U.7..{.)u.z.S....dL...&.e}.[.`....#.._m/[.UDD.Ln...Z..7-..%D...<i7y...vl...+..o..\.".gg@....<Lg..H....5...k..@i....Yl...=Ky......z.X.....|B..'...x6.....]....2,@~.I....y$.;z0t...:.g.q\.N..&.....v..E.~.'...iw.<.H./..09.l.....|.U*...09.ar:...;6..Md.U.ZYs..O...?LN'....2*.~......p.V..n=......N.h...,={1M.5=....E.....ar:{...=.........N|6zHj[.[6>.....R......m..Op/.~.......s.).>..J?..n....DOVp.}||.a.....&.z...w..OT.x.I..k...~....M...k+.+O....>..)....<.a...7....O.n..TQ"..3}JvC.....%..F.t..'...<.~eb..S.......;\..'.~...W.s.I.i5<....){...[..a.....M.....G.x..\....NJOD>.....Zri.6t..gQ....(EcM...k.[.(5...W.........n.p.-.d......m.........:.&..\....W.....7..,e.1...R...U.ZX.d..{...~.......&yL.Z.9...HX...!.K.-...W-C."g.7..x.....44....>....F...L..6iL...G..h..P.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000006

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33115
                                                                                                                                                                                                                                                      Entropy (8bit):7.993767780656695
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B842C2089E6BCB48CF5BC8C072213D73
                                                                                                                                                                                                                                                      SHA1:1A9A3DDF37D99CDB638B2769F4735D6C7C2B5EEF
                                                                                                                                                                                                                                                      SHA-256:ABDF61156E2655B8DBBAC4A36F165AA4120FDD3FC8A9951F14DE591CA5D96C77
                                                                                                                                                                                                                                                      SHA-512:C788445F07943D10DD1C736CE23C7B3546103FA5843DFD963E64A029FEA4F7EA572290B2FD578FA9F73E96EF23A6B0D073767F8E991C01037ABCDED6BF479D04
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:S.y.Q...F....[...I..@#e.....`...aZ...r{.>.G....I"~...n..C.T*..u....W.;.%.c.Z.U%...M.E.Q.Q..-.....u...dY...e9.#...Z..V'.P....,2.PdG>.2g....j../F...{.{AU........M..|.}......T.x|.n.P4..HI..p)..w...%.~........Z.BfQ.k|.q$..g..b.SU'h..8.`....S.w...n...h.h,.qa.c.TY.......*U&..{..07.......T.QJl....uK...kO.h.....,2..P}.Nv......q.C\&..6..A..{..C.....yK..,.....OMM.p...c...I..*".".............F.?..R...?.y1.....,cU.V..3.{'!...<...eL....qK....Yg=...]...]1.(d.?o.&{....&.G.>..[....Pmq]N.-. B..D.o~..0.Z....@.+Iu.iUU..{.S>v..>........z......N....?.!>.......^.A\..$..W..R.O..o..0.\.:C.:..........Y.uR..h7..._.......$)>&;..._\..C.[T..Z......2I ....4@b...}...?....9..zT.U..Ag~.s.1..~8..+..oF.......;...L..j.a<...O.*.L.......W9.RW..p.D....Z.2|.6..!. p......c..2.9...O.C....[..Z.....q.8.8;........_.F~.>t...o..Y...o..._......._..k....D]......Os.80...ps.3......?.O.Oyxn[FG..S,.u.nxn..vs/.>.g...7..Z.......`.|...><..s..'.]..1<..a.{..:..gv.;..~.0<sj...{.]..Z.F....9=<S.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000007

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33314
                                                                                                                                                                                                                                                      Entropy (8bit):7.993241992390373
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4EFB98A42211275AC394BF63F25ED999
                                                                                                                                                                                                                                                      SHA1:3BA6AD899CBFD1921C0983CFA4D1C86AC549E1ED
                                                                                                                                                                                                                                                      SHA-256:639C9795DE65B600C12D2896B2B5992858417366E4B2FB9A3318C7E57214BC1B
                                                                                                                                                                                                                                                      SHA-512:D1C35E38998094E44144B3C372CCCE33F25880A4586D61859F2592F8C6DD5C036F20DB01497BBA5409BEDFA80E9C3D8D246445FF4C77CD7A439B736722316D24
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:Sd{.Q..."*{?.-..'.v..........q...i............'..]0lv.l...R......=...xH....d...4.$X..........r.e./LI...%.Y......i9PX.......O.h...'..*.86J.E...H......4..v.#..e...}.>....{.>..B.P...6..nF..3C+K....DZ9..|..FJb...@.. ..}{.O.M.e{..z...pDd...&.FD..|..c...gr..Q.#(...........GD..D...C.,......40.N..2.ZwsZ4.,..ch.:;...". F2..a..s..HPi.n..j..%N.3.. ..,bi.....v.^...CB......./...ir.0..t.M'...bH.>........}.4....`..LY.Z...3..W.2.@.K...hid*."......_.Y.b+x..w..1).`..j.?....a...\.c...rV.......v^.w_x.....Q..u.m..2...O...=x.j..W...(}>r.?.MO..$K]......=..(..gt..a..|^B.R...g.....F.......q.w(O~..T~.6.t....{M..uc..N..h.YMk.jF.A...W..p!x..u.J....$Bb.......JX.{.L{e.k.3.3........i......i..`.m.7VA...O.U...R...../.....I.......$...:........\....?.o...%p...7.?.. ....{.S.....o^.X....Z..?..$..u....i}..Gz.j?...Q...o.............!.T......!...[..\?....p....:s......S..m.._.....`.K........s..V....F..b......O....Lg...b.!..pqN3.E~.)[...v.;.|.jU............B.V.N...yf.P..I...v.8.P.....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000008

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:PNG image data, 1000 x 400, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24898
                                                                                                                                                                                                                                                      Entropy (8bit):7.7614581089446935
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8CFD938B1EFD79B772F3416F51CF51C7
                                                                                                                                                                                                                                                      SHA1:FF1FBE996A3F81A4F1DC592CB9AA02B383BBCEA7
                                                                                                                                                                                                                                                      SHA-256:84CC8D30172D2861A18BB5CF144CAC603D3602FBE062B63C7A8D9415D7208E8F
                                                                                                                                                                                                                                                      SHA-512:87182211017364266F1C2B4B5357D7742FAA99180B3F9AE138704362195D8D60F030B5B2FD7628F5A19A08AD91E370182250B5AA5DEF33C9472A25E8610BBDFC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............=MJa....pHYs............... .IDATx.....T.}.q.I......$Mkm.&}.41}mk[M4..(....iMZQsQ...#...F.7.....Z..... ..., ,..........}~3..........~....3;.....|...?.(.......c..........................t......@......`..................@........:...... ......0..........t......@......`..................@........:...... ......0..........t......@......`..................@........:...... ......0..........t......@..........W.L@.Aw.@\_J....@..}...j.......G.....@....l..q......../:.... ...p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.z....u..@ug.._.....uxh..ry...-......@....G..O.[b\.u.N....\n...Y..p........@O8..\=....PN..W....J[.e..vv.}.\/.!o_..\E............p..y$...(.Du..]. a/.nmY........t ...@7kW..=..V...r...u..(......?../......@O8.........U;.0.v............H..=..t3vi...%.3.....nmMo..G..........p.z.....a..@....N..."}.a"....H".=........A..P>.8......@r...G..{..[.".c.....d!...@...FM.9...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000009

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20815
                                                                                                                                                                                                                                                      Entropy (8bit):7.990103220903977
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:500CEAC8DDCAFD569DB0F00B7825F751
                                                                                                                                                                                                                                                      SHA1:F7F513BD4E3F7091EFFE2F5E724A4A7611014C66
                                                                                                                                                                                                                                                      SHA-256:23547FD025886CB56CE520FEC03339855411617D66F88D1F885F07EEA6B9C8DB
                                                                                                                                                                                                                                                      SHA-512:17809247DD5E5A08E18414BC9268289273C4381D01883FF39004FB6F2E49B4BC711673A512236070AA27DADB413D01FE9F485803804D732FE16584DA3953A947
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.L............_....w...Vm4#.-.....!l..H.9N.u.....6.~..[.>...Y..J.....\IW..H.,.L....|/.G.(}.26......@`.+0..@U..{p........}.....E.. .H.RE.<..9.2DR.#W..H....e.v...Y..?G?~.y.i.^...Q..?..._.y.j.F...C.....x5...{......u...l..xur.m.Y..:.N...k.k..l.._..0..-la._.......=..n.q....[.9~zn.b...&.4..o.../..R...a...........yM.y.............:X..An...`.....u..q....-N.A...N_.........D.f...+.N...#....)up...i..i .p.9_.....F.....u.$.b...V...>r......E.1.......z....cz..,.Na..<...l.pw'...J.=t.].cx.......e.R.,..=...~...?../.......\.w....~..t.8..)..x1..v..n.7......._....!x..V^.g.....~..6.....s..*.......h...Y\=.............C...^...w...3......u...Z..P..d.$0.[>.w..b.z.I/$..p..-...,...aSQr..*.$..u..-..W..R<>..eM&&.K ...6....M2.m..\..).`.....1...TMQ....2t.:=....w..c?...........'.x.-..g.D.L...P&...j`_....F../..0..Fy.G...%..Cm....V.<X.E.,ngK........6..0..<;4.f.....O.RT.l..}...........dU..j..l..*..+....V..V.Fv...\&J..\..Ol....dR).f...%.....L.ee_M..0..$./.f.Q...E#..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00000a

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):42635
                                                                                                                                                                                                                                                      Entropy (8bit):7.994805230792423
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:51117AF1BD83CDD09C453D29EA7E4760
                                                                                                                                                                                                                                                      SHA1:32110A04F0C0435EF9E70C18AEDA61544E75BD4A
                                                                                                                                                                                                                                                      SHA-256:08C294455131D8AE712193CA0E90165EFAF9AAF9BA1EBC5F979D4B015D9D3CB8
                                                                                                                                                                                                                                                      SHA-512:36B509D4BC9F2BD49D9EC27B0EFCEC0962A7065F943A6EAE2EE153F76E30AFD6396912C8C729A61B1759FDCF68FDA14E3191D98889DD81E28951D0A51E2E60FE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..?.U..nDjV..F....G..9.?.g..g...)...!}.vN3$!.f.. =...R.9.......k.x......oGww..2....U.*l....q....%..(.%".....L-.sA.rA.R...H6.+l3..v..`a.....@...zf.p.....p8....oI.2.8..k.P).w.......E.R)...`.w....n......B..0...k.d.'..K.#."......O..6...{..,..q.K<K.\..=.?..'.A.?........}O............y..o$_.e.5.....Zs#&.P..".I|..S.V.EE....&X..>)..kDn[.L7F...D1~vr..%.{...A.C0G.:w...nW..H.+.?..j.."p.d....dd....D...R..h....&...o..T.N.EO'.L]+.iS....S.[..I"bH.J..}s..D.l.:.!...l'.....|k..'....(....nC...o....A.l.v.....?.O.Z....l...T...1ejX.=..6....E..A.$.M].]*YgR..<EZX.QT..V..`}R..t.4p.....=.q...#.>.....IB...:.L...e.R!...mX..].H..n..........T.........S..w.A....Yi...#.$..].V!}....:...v. ...vz:. ..O.vz`...:S........&\j=..._Z...b..... l...|.......>MxhG.1;ni...J..c..&.3m.,..M.JH8..x...u..WQ..(.H..`R.....7.t#`..0B1.QZl..~.J..6..U.)gQnE..R.'.|x.c..}h`J...;....R.,..Y......._;...l.n..vz....AVeE.+.O........{....AX..G...dY.C.m .0.)F.08pt..v... *...hh.r_......H......V....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00000b

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):31372
                                                                                                                                                                                                                                                      Entropy (8bit):7.991873792343511
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8EA33390547869C7CF8EB22600324B29
                                                                                                                                                                                                                                                      SHA1:1993125DD116A4BD23CB2333FDB9D585DD1F73B8
                                                                                                                                                                                                                                                      SHA-256:5C9EA9FC0ACEF631E40AD4C3D12E7CE9B3FE9452728A78BF8A78FDC222F38ECE
                                                                                                                                                                                                                                                      SHA-512:D698D48CCDC34FC904044931E3448F7C29F61AE5C946BC656F35592E488D55FB4F0D3D3A6B611BD9585B0A2AA50FAF3CEE4AC1F28FB0963433DEF94F640A9EA1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.z..f$.=....z.........w...a{I.,.N..eg.v~@X.B>..xe.J.U.[2.\IQ..._....3.7'...I.q.B.........{.{.+.TwuPm.B..A h..4@.....*4...x.0.....r......f...0...8..db..#...cd\.HI.....3. U..1\.g..).wiC.l:W.aM..../cZ.KEe..BV...5?......!.%@. ............P.US...=.6...A..?Q.......~...../j|....s..4Mt.W.....6...D...39.B....HD<pl$"d...C..l..n.m...6.D.r2X7....(+...y..R..l..4.'.C.<k.m'.....9.i@<......t.9....F.t.]..e`.D.A......@..Pl....... .k.[..B.|c.......$..Y....00.YR..]-.?x]........n..s.q...}..pe.,.....v8ab.?.3..6+..f~....C...........!.......j..B..N`.1..n0p#.6..?.,..9r=];...:r..h......EC.$..5.^.i.G.C.iF.Si*t@\..8A.;..0...5M.1..b....b0.........Q..P..T..TH..h.......5..8...[.8..$$k..B0...8<.D...$..f.."0K'.;..L....v%;......r..w....D.N.o.._.G`._>...p)L...........g.l;R....%.|.F.in....)t.2.....BT....q..n4r..P...D..Bs.7M.z#Ek*6.AKQit....J....I...M.4.4.?&.4X..@.$..'Y..v.kn..4,..........t.:..1A4l...I6R.)....+....?.."Q..c..k.....8..... ...T.....v.NR.Hc..l.....D.q....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00000c

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33339
                                                                                                                                                                                                                                                      Entropy (8bit):7.99323895556392
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6E3FCA3BC802441C4ACCE79FB3BA55C1
                                                                                                                                                                                                                                                      SHA1:11A6BBA3E69718C784BBB721DCA6D7B9D3331504
                                                                                                                                                                                                                                                      SHA-256:3A7635FC532CD3257212055F2443E7FD0A69C6CF09936E7076E16C8B6F5C6249
                                                                                                                                                                                                                                                      SHA-512:7243833797927CC674E49C570ADF01B14D1086D426701E974C882C3D86BA2054AADB5DCDB58951BEE96C937F572322EE91DE2522C87A90EA798A9824E9C68EBF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:S..1"U.SDz.j...#u......7...}./......./..0.l.*s./.2...C.......bI.f......~c....v....]..3..Lb2.'.&....5Fyf..{.)..$.....0.V/....../S..=%P.J.q....X.z.9K.....i2..f...*..).bL.."@...,@.YEvU.R..Z...^..@JC9.b..Z......dl..=n.;n...q.5......qm.#]....K7.#..$......F.,cb.7G...l...L.9R..y...R.m.e.Rn..."..B`;Z.G.g7...?....@.X[>.=..:./UlnL`...].#..':.[...N..A):v,..,g..7.X.l.z..xB.<.w.od~.,..Q.QT.Y.)I......S[V.t.X..........b..A..%#.7.....*A...5..J9..!^....M<RTp.:&V.....0GX..p(.H;S%.VLO......L..0.:...`../..Jb.r.l..A.>.....h..Lg?..:~G...+...E..f.|...."..?.+.Z.z<^.$...C...3.....e........M.<............{D.-..s..o5..;..#.....;.Y....>..rf.$...V...e.,)..e..Z..R..I6.1..o.ES$%T.0..l.m...Y...p..D.......Q..Y5..F.._...^f..........xjZ.C-.}.f..Ua....#.-....a((g.[0.s.....42?...e.....e.>..CQQaJ..L.v...VB.W.ggg.t^f)7......,..... .(.."#.IT.....{.$....@.`...Y.....;+<!..Rl...Q.|.......b/..!..z3...Ss....^.Ww.|. ..S..w..L.2.....?!...'E+aX_.'/Pq82....Ce.y'..Y..P..n.BG.r...>+2Q..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00000d

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):94204
                                                                                                                                                                                                                                                      Entropy (8bit):7.997352886051361
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7A2BD1523EEC58EBA38D84972791F8F5
                                                                                                                                                                                                                                                      SHA1:61AC5ED4452E31F7CD4E1AF795562533E157E2EA
                                                                                                                                                                                                                                                      SHA-256:6B0DB009E57B7DBDF99A796E5FA2BFE40915594D54BAC4298D6FA478442DE7EB
                                                                                                                                                                                                                                                      SHA-512:6CB548E28612E29228376C5D56DFD3857BC528BDEAD9F8DE687124F105C325CFABCD1FD56DD69C1607C333F57B0C1DCB696FB7AD22BBCF5C64721B9A085204BE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..?.HM.....>.}..Z....E....u.#.......J.$c{,9...^.D4%....@9..+S.......}....BD....f..,L..2.@V. .,......].|....-H...2.... ? ./.K......'k.W.$Th.L*..:.....&cJ{.".....U....H.............h.#d.w.......*..............t.R(.....n......1Sz...P......*:.;dcl.i......>..26.P./M.?y .Q.6......3....Wj9B..k.5ML..5Z.r....@6....C.a........Gx.]....c.......G..k..Y~qJ...w.Tqz.?E..g....A.....xU.rv.#m.H:..k...j..2.d..T.;..nUXS.^M\.e.#.7;.?......$./..t>.......'j.e..... .R[.3B+...o..E.c.Z...Bs.....tG.N.X........5).x.|.e...oO..FF~qvz.....O.'..JF~zv1:..%.b.o.]..A<...%s}...q..:.g....[.3+.....D.[t.D.lcV.$....$j.KU.`.$Z~..PK.J?Y.o.&l$.OV..s..-.{z..AYW.../vPF>.}.7Z...&!.d..1)C]...e.....Z...=...L...5.Ml......CaE..5..8A..hD.VS...n.f.....l.f.e......3.m[Rv...tfl..2.S..e.8..o..9......yA.?...9).......!.\..&.....'.}..My.....hw4[X{.w[.Ic......@.........X...g..-.0..o.3....>......V.(...;.}.YMN.....j._..l..2....}.......\....E3q...!./..am... .....#.A>9..4.K|.....X...KC"..9).w..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00000e

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2565)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):232659
                                                                                                                                                                                                                                                      Entropy (8bit):5.548408251018062
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:78E8954E7D740D9E583B456DA2DA24D5
                                                                                                                                                                                                                                                      SHA1:44806DEAEC0FFD5F82C3A478EC36BD678427F4BF
                                                                                                                                                                                                                                                      SHA-256:5C90BAC84DAC0D2C136C3D848C16E577182426D95A4F543AD56DAA32C5E0F919
                                                                                                                                                                                                                                                      SHA-512:F2EEA06BE5CCA38F442ED8977FF52659B93ED63E0E6945CDAF53B387C08E833DF9F23F97ED1F4579FDEE4322D0B3C8DD0C15EF854461B6AD4F779CC29B535C52
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.// Copyright 2012 Google Inc. All rights reserved.. .(function(){..var data = {."resource": {. "version":"11",. . "macros":[{"function":"__e"},{"function":"__gas","vtp_cookieDomain":"auto","vtp_doubleClick":false,"vtp_setTrackerName":false,"vtp_useDebugVersion":false,"vtp_useHashAutoLink":false,"vtp_decorateFormsAutoLink":false,"vtp_enableLinkId":false,"vtp_enableEcommerce":false,"vtp_trackingId":"UA-62117061-23","vtp_enableRecaptchaOption":false,"vtp_enableUaRlsa":false,"vtp_enableUseInternalVersion":false,"vtp_enableGA4Schema":true},{"function":"__u","vtp_component":"URL","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"HOST","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__u","vtp_component":"PATH","vtp_enableMultiQueryKeys":false,"vtp_enableIgnoreEmptyQueryParam":false},{"function":"__f","vtp_component":"URL"},{"function":"__e"}],. "tags":[{"function":"__googtag","metadata":["ma

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_00000f

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):152738
                                                                                                                                                                                                                                                      Entropy (8bit):7.998343998597886
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1D4815175B5AE11E2F5AE08A59A25FA6
                                                                                                                                                                                                                                                      SHA1:6BA34A017D857A1F849915E25E0B4F7E0F895D3C
                                                                                                                                                                                                                                                      SHA-256:A0629FDAEA0F7BEDE6E84B281F7EA6DEE84CDD2E1A5F4B1E30010B2E8A3DA7FC
                                                                                                                                                                                                                                                      SHA-512:A25874F7E66957888E5A2110A0AC4342F4BED2619792EC7F3E452BDF272F9FDFE5767E190C62FCC8E52F36106C8BBC851AE89FF3CFED8C0BD75EE0F313CB261C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:S..We.....p.....q...}...Z%..a.._......%08&...e;......l....++>k~.:U;%B.......m}_.P..2.2..e.......y9.e...,.B..~..~..a..+..tB..11......E...0..:......et.t.fZF...j...L.6..fTR@...t.z....+.M.....n....(..dD....H....Z._.13.I{...S.m.V..e....V) .,....i....-..nI....FNq....J.3.f....#.s....n!.U..V. ..@.....{..uo.*T.r...I.zf._..W....W.'.~.i0..%9.a.............J...7..H. [k.?.=j.Y._..nll.8.^.O...(s.......@NGD&.2.......p..{D&""... ;!.-...,a.....c....R.H~..3.......W.g...z.y..>7W."" ..x[C..'..s.c,....\.m.......V..%.C...l.I..`..0E.!.K...M.m...B..DM._m.IzgK.[. ...1...?n.VV..Q...-.....G......^..[hZ....C...9....._...n=.:.}{..RJ..$.............h..Hk.Ft.@.....&n^.}..Fr.7.%6...k..g.u........b......;.....v.....`.#...(...B.8...h...".....>..h74.7..qV.....Bs.-.H....[.I.<...@)...g.>L...~.h.W....c..Rw.q..+.=G\q...p.W.....z....X..<1x..m"......S.....r.......o.t..../..>!_..$.#..!B#..W..N.....@.'=...8.y.X.....o..E...6..N{.m.-q....n+....=.F..X.Ew1.E.h1..@..'1..=.}.d..e..r

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000010

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:Web Open Font Format (Version 2), TrueType, length 48444, version 1.0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48444
                                                                                                                                                                                                                                                      Entropy (8bit):7.995593685409469
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8E433C0592F77BEB6DC527D7B90BE120
                                                                                                                                                                                                                                                      SHA1:D7402416753AE1BB4CBD4B10D33A0C10517838BD
                                                                                                                                                                                                                                                      SHA-256:F052EE44C3728DFD23ABA8A4567150BC314D23903026FBB6AD089422C2DF56AF
                                                                                                                                                                                                                                                      SHA-512:5E90F48B923BB95AEB49691D03DADE8825C119B2FA28977EA170C41548900F4E0165E2869F97C7A9380D7FF8FF331A1DA855500E5F7B0DFD2B9ABD77A386BBF3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:wOF2.......<.......l..............................`...\..p?HVAR.m?MVAR^.`?STAT.N'&..>/l........>....0....6.$.... ........[..A.2v.6......$..e...w"../.L.p:......Tpc..8@.[5......d#d.xw..o.O3-.....%..>...%..)~p.K.J.H..S...s..z..Wa.. 0\..J.....BL;V..-.L...j....^.9..HO l..,.*.6.v....?....x.....m..;....a![zif...Ur...Q..P.&.I1..:n.p...j~..h...9.!....@.<.bl|.Y?h..B.j/..rH.S%/~.^D...6..D.4G...y....Y.....=/o..W..5ryo.d?.gA]..?...1V..S......7ZJ...f....mBG[0eW....y..%B}..]? ...,sR<.y~.~.}.%.!..,X.....`...R..^....S.....u*.?k.v.k..U.u..M..`!...b!..X)P...y{.........n..T+6...R......L...x}...g...].g"WT.b..h ....X...=;{w...QO.s..w..@.(,..........{.........1..@...(...\.......9*..2.h9P.G........K.Dp...F..4W..ui.u...G...s..x7.?..tg..D..O.sA..t.t.4..~..e\...X.....T..kf.qfX..=^_....g"....De...x[J..A..).G.YUhR.....0.l..#&3.'.K..*...........$I.Pp.../.s.<@...r=..S......d..P.S.B.w.~X..ZK....h J.`A.bv,=.....>1.Ev.^..U.A. ....EU..].........dw..!$.A`..B.._.....Z~..!..J..l]r.m}m..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000011

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):80272
                                                                                                                                                                                                                                                      Entropy (8bit):7.995890784824037
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:313EC9C93C6EF6707EE4600123505A04
                                                                                                                                                                                                                                                      SHA1:78F3066CD505AA1B4F0C59A523182D7D49798B36
                                                                                                                                                                                                                                                      SHA-256:A4F17EB5811EC9B605670BD2881A15D7D315D60A055665654E551BBF95C216A4
                                                                                                                                                                                                                                                      SHA-512:A9B904D87ECBABB38EE49469B80C0FE6F042CE94D6791AB3FD70661A9E1E2FA3C0ECB252BBB872AC157331B57F6418BFD0856066CCE735A90D2EAB56829031F5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[Mn3.a..8.pu.l.....C@u&..?~........e;....~..../17.;s..A.I.o..rkqI#..i D.......V......i......0........CB..mpl.4......3..}..>../~.uY&.....K.HIec0...........KzQ.....WS.L...0dr.R.%..'<......Z_V.BPR......j.e.....U....u7.9...-.{........I.....).{.......*..o.._C)."@*.....l )C.LC.*..-...)eu..j..u......^...8c....:v*%%..C..;{.jB.....~.zkU..%d..~.#u/@..MM..%ZZ....d..f@.D..t..12,..r...8`L...._..""EzH&....>.V.d........_..........hpU.qf.7.r..Y6h.4..;8;.....owv...h....;.6M...!.`.3...{I.....`.3.......?..h?>..C..v.....G.q..U.Z..c9"@4....# ..H..E[^.BfF.....qH,....O.X.l.$e.z|.?.e..? Y.......1.V. $.....\.".....iY..Hd...=.6M.\....$.p....jE..h... ..VJ...#J.}:.Z4.(.97M.....r..O.Ow.F...=.vG#.f...TD....,Z.........M^.fR.Q.._.V.afo.oY...i......c....P7....u..?.}.....~....5.f1^.~.L<.T...5...p...e_k....cWL............m..."....O..5..^d..A@......Z...~.B...........N.;.^.m.........m......$.`..w..'..m.T...2MC .........7.-aF>f...o.....'w+...$j..9=."sb.^T..s.....t.(1KS.$.dtC....$..5'

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000012

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):111024
                                                                                                                                                                                                                                                      Entropy (8bit):7.997441693961285
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3A307B2A715A63D30982B892F3B667FA
                                                                                                                                                                                                                                                      SHA1:FC181D5D7FA4B640DA74A8E8D78D0D892FF1D597
                                                                                                                                                                                                                                                      SHA-256:53804A68E29129DC7E61AD4DF1009E295745DBED9A83DD5928DE05FE1330D23D
                                                                                                                                                                                                                                                      SHA-512:A2B98BA7A344FC89FF7793F0D992C13EDE8ABE1E5AAD698B816D08F176E20217C8CC824B9ADA0F454788ABA38BC5B7C798D4FABF732338BF1B8C68B8BE68A4DA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[Z.U...z.8...~..Q...O...q...6...V.qw.............?..e;........\........KP^..2..C...`..Y...l].".".N..........W..{.9..!jW..sm......../.!.BH....l.w...Ei(..G..H6L..!.3..NwO..|....|..J..FW.*...K.*.-..:!V.......}........\..t~..2%.XP.............].8.h.....6]5.V.bsk..D:.lP...oZ..02.P.-k#E...E...L&.H....\P. ....2(..@............z......>s@...@..{.&`..=....&.d.h..PI.F.#.*T.$V...}... ..j.W(e.......Jy.<......4^.#....i$.Fl...=..{..L.g. ...k........g%@.`...3F...\...._v.....d.ZX...].f........{.kI.Q@.....iu../3......?.......H.E..Sw.-..J..dL.W...*...%b..e9......A..Dh.N...d.r.C.1............Z....6.u&.1....BH...i.^....l..JW.5.{F_...~.,I..B..../.K...0...b4>x....h.3?.,....}....|......c8]..$, .2..G.1..Nx...;`{m...D. ....@.]y.[?1X...U.A.h<....7."..+9...3 ..MX.s\oG.e...J!.E....a]......V]......S..,.P2D .h...[...RBaw.m-..:8...^^..........tL.5..~.a*<~C6...4bQG....b-..]..,.4Q3....=.i..X.-.B.w....ZY.tK.Ic.z...FB.b..5..G.,..Sk.jU.GD.*2........H.s.h..{..S.......9.nr

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000013

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (2343)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):52916
                                                                                                                                                                                                                                                      Entropy (8bit):5.51283890397623
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:575B5480531DA4D14E7453E2016FE0BC
                                                                                                                                                                                                                                                      SHA1:E5C5F3134FE29E60B591C87EA85951F0AEA36EE1
                                                                                                                                                                                                                                                      SHA-256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
                                                                                                                                                                                                                                                      SHA-512:174E48F4FB2A7E7A0BE1E16564F9ED2D0BBCC8B4AF18CB89AD49CF42B1C3894C8F8E29CE673BC5D9BC8552F88D1D47294EE0E216402566A3F446F04ACA24857A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var n=this||self,p=function(a,b){a=a.split(".");var c=n;a[0]in c||"undefined"==typeof c.execScript||c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length||void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};function q(){for(var a=r,b={},c=0;c<a.length;++c)b[a[c]]=c;return b}function u(){var a="ABCDEFGHIJKLMNOPQRSTUVWXYZ";a+=a.toLowerCase()+"0123456789-_";return a+"."}var r,v;.function aa(a){function b(k){for(;d<a.length;){var m=a.charAt(d++),l=v[m];if(null!=l)return l;if(!/^[\s\xa0]*$/.test(m))throw Error("Unknown base64 encoding at char: "+m);}return k}r=r||u();v=v||q();for(var c="",d=0;;){var e=b(-1),f=b(0),h=b(64),g=b(64);if(64===g&&-1===e)return c;c+=String.fromCharCode(e<<2|f>>4);64!=h&&(c+=String.fromCharCode(f<<4&240|h>>2),64!=g&&(c+=String.fromCharCode(h<<6&192|g)))}};var w={},y=function(a){w.TAGGING=w.TAGGING||[];w.TAGGING[a]=!0};var ba=Array.isArray,c

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000014

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97196
                                                                                                                                                                                                                                                      Entropy (8bit):7.996205664568926
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:672F7221AD2DD1FEFE3453C379834173
                                                                                                                                                                                                                                                      SHA1:3741A6C2F72FBE150E7FB0347A5EC32F1A934A3C
                                                                                                                                                                                                                                                      SHA-256:45FF4266BAA359179E52E6ADCA99BFF97BA69607FCD4A490A9836D90235F30A2
                                                                                                                                                                                                                                                      SHA-512:A536891705B47B4C1C4C0321AE1D971E5B99CE4D095A3533BB67CE78D00BF9F94295E5E9E466BB496E5A9BAC1B9DCD83016690A65F1981A718958627D2020344
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[.9TD...!........y.T-.2/X....?..............o......o......E..t.q..3. T:.d,.............k<....!...jh\.. ..0y).\.K.m.$....u..~....g'oI..N..(Ig}.u.W,9.,..f...5.]&Y..p.1i..[....M H<.*^U.......?_.N.]... ;...=Y.$OS...&.b.B.....K+.. yNfu.9..Z.u.t|.dVg.J.j.5g...3._..#....#....h...3.....`..#..#.......f....9..j.......3..fU.5.6sv.d.4Y.Z*[2Z.m........a........dy..i../!c.m.^.C..k5QTD.i..D.nJ.B..]..p..'..M.`A..G......C.,...c......S..Sl.n5......*" q...k....._.I......_...Vv....-$..5f.....v.....tbw..?...lq..sc.J.....wRU......0.]....6......e..`.3.....6..._.O..1(...^...N...m...@...-.*.a.[q.._..@}\.S.......R.....O.d..{.m..^.B.H...)..C.....65.V.t.65M..6.C.Pi.A...'O..'...anjp...6.rN.Fx]+....{....rH.a.....IH....9jE!...X....Y#.J..;b.[!;ov'..4..N._4V...P.......pN(..7.k.........v.}6..u..O.e..jVK].....=.T.u.....5;~.d.s.7.^.......z..V..40{....../.5..jj.E7..4.....L#!....p.*.Y|..i.V.{.H@E6^.5...5..=..8e..IQX....6rdm.......+.]i.%Z.>3.V.y!J.lf.N.....e..S......@..0......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000015

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):56085
                                                                                                                                                                                                                                                      Entropy (8bit):7.99621823325508
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6E5092134A127E6F8514C54F7A9125C5
                                                                                                                                                                                                                                                      SHA1:8E992BAC3DD1CD350059D3728DA1D415B2276D1B
                                                                                                                                                                                                                                                      SHA-256:153980EAFEC4A329EFDAFD8910AC472C98C132BF0A605D8FEC91B10EF2FFC4D9
                                                                                                                                                                                                                                                      SHA-512:907AC23B8177632D8D99351FFAE06B16C83D401C6FECC710BC99D8F65B8F04412716A1D0FAF39881353F5F5A2E19FF1A154238627E67BB7164F6CC53A61160F4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SjuS.7\....\...AQ.<..s...........{...PUM9:.p..@.......R..!r..2..+.z.J.H7...mS.F.Y.ez...%.9...(..Q..j.a..h.3...5.s..P.....o.l..7%G;N..?.\..........%.oxc.u.6.......f...u@...hT..a...]....:.t..p..c...Xq_.^6S..i`..o$6...-f..u...t}K..)...3B.9.....4U.Z.3....M..c...3...hq,.[.<?.......tM..!.2..{.*...F..(..`KF.O.r..v...Z...e.q4W...L'n[J..C@.I.9Bv6.e..L..Y..........{....p!......O.\m.t../.D............$iB4x....._.eA..Z.../..w<...y.ow...j..!..fE.2..S.'.......+W.y*}.8>-g.:.%%...O..^..S......|S....b...._.vRG..(.M....*)....Z..Y....9W.sV.-mJ...-.[dZ ....YB. P.;.[.uV$..9.f....K{-M...2...]..i.[.L..,...pXrK......_$M.N.?....m.3K.......u..D..6........n.....Z.}.u.QE......#...==..C...0u.'<.....2.......U9{.qQGN...[j..3?.`.*..l.V.^..b5.H.:..ow.X".yW.m3L..&..L.]p.!ApDSz.G....EF$.t.$.RM..: D.a..R..6.c...f.u.......f....1...x.gk..m.U..N....,Q...........J.Lv.m.......e..~....."....)..1....u.......0....%=;.{..%@..B..~.N....u.....c.|N_....H,..T......W.5.........<..|...^.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\f_000016

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):29523
                                                                                                                                                                                                                                                      Entropy (8bit):7.992172018788262
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3FD3637605E537B6EB6D4EB0FE3D14EB
                                                                                                                                                                                                                                                      SHA1:14455061B6BB6C5D79D41FEB1B53FC0447154CE6
                                                                                                                                                                                                                                                      SHA-256:3BEFA56BBDF0AF20F559462AAE55F0435D52A0A84629022F1C277057A0D92B98
                                                                                                                                                                                                                                                      SHA-512:771D1CE2684DC88410E9D6B25998C526B54EE898A3C3232EC87CFCAD0D2424B03B25A75BC37081C24DADDF270E215C8072062A53088D95656A9AE08DD2A1A37B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..3j.6m.w;0...E..?F.b..a......9....nIA9..J.vcDr.. 5....7.E.|g....d...N$..3J.......U..X\<.D.._].#Rp@;d....7...s......%..)JhQ/.2......T..5....J..{.R..T.f...t......q....IN..6..#..... .X.......?.....zUG..do..eb...{(...........0e...pc.8.o...C.....D.e.Pe<{.h....n.Km]...5C.f.j."Z".../{5..=-`B.|K...\.Y..);.a{.R.H.....S..P.o....qQ59.b..e.m..!@..M.-......6..U..4_TY.N..}P|......P.l.}...7...fc..F..(FV.SU.v.....}...r..Y.....%...a..#.. ..W......6..<np...K...g..`.d.....R&i...X.H.{@.P.....U.fv.. (.j.t.....-6 H..9.g.#..=..|.. L..J$%.IIn..U...@.#H....$.jZ....Ry.;$.....!....YZ5.....z..Y.v...6.\....../..G=aH...n!I..w-..M....m.....XIj....I..+tZ..v....IW..l=..8..=....,...n.......=.8.r.)..F. p.e.d.9...].o}.-..w..~.8....e....Ia.P...[....19.s.....O|..'s.a`e\l.....Z4{..j.=h5m.W..I..j......~:.j..2..e..d.... ..H........OD[.Hs....EfP.;.=.}b9....NQw....N),.$....{_..^b.......v.....U4..9..2c;..@,..0.......8rv..j....Zk...j.....w..z..M_..._V]..|...d......~.r>...J.!

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Cache\Cache_Data\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):524656
                                                                                                                                                                                                                                                      Entropy (8bit):4.989325630401085E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:92AC119C736EB2D44B400E549E9210C2
                                                                                                                                                                                                                                                      SHA1:0B9E293644BE663C7307FAE33985BE9DD262D20F
                                                                                                                                                                                                                                                      SHA-256:B80C63A822CAB9D5312CADE28337F2B2DAFD121F5FB71C3D93C150753CE9806B
                                                                                                                                                                                                                                                      SHA-512:E31C149EFA9C71D2395FDE37AFD468292C8A0759AD490EDC3880FC760CCC221E4A64D9587DFD433E7B3C4B5834DD0653FB6413EC93901C0F596435EFFB4EF18D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................J..p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\067ebc3d83f706c1_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):301
                                                                                                                                                                                                                                                      Entropy (8bit):5.285147495458993
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:02EF50E4244C55591E46FA0CD53390D0
                                                                                                                                                                                                                                                      SHA1:00512BACF57FCA0A9D50F551B8608F1061914AE4
                                                                                                                                                                                                                                                      SHA-256:92A86815FAF514B36913B80A8D3CB8FC125FBB26A1A3D6E7A64F975F1C09A833
                                                                                                                                                                                                                                                      SHA-512:039CCFB167A7ECCD00FD40682B62FECC8477BAC358CE50106121B6F95126F2453027482D9448041BF0BA5EE1EFA43B88C15E27EC31C258FEEA3DF0E3FFB03EEF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......M..........._keyhttps://static.hotjar.com/c/hotjar-3623287.js?sv=7 .https://shiftntp.com/.A..Eo.....................p./.l......................................B...T...b...o...........................;...Z.......V.......c........0....f..C...U........']...F*?X-....A..Eo........|nx.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\0e152b6dceeae19d_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.3753144208472
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BA516C55B04969F12A300CAF6C443BF6
                                                                                                                                                                                                                                                      SHA1:FF599B4A997909A3B9449B9BB5A582AA2C72FC0F
                                                                                                                                                                                                                                                      SHA-256:B05837928BC4DD62D7F04272957591381E88EE427D8CDA26664E7877976E16AA
                                                                                                                                                                                                                                                      SHA-512:897C7E5F3DA15D0196BD96D319A3336F2840B1E299EA1825FA58C72A2CBE987E59C3F008BEEA7C3DC44E561B17EAA530C9DD33EDCE252DAA33D4BFED69E1E66D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K...l......_keyhttps://cdn.onenews.com/public/_nuxt/DVUdz01n.js .https://shiftntp.com/.A..Eo....................`p./....................oN...........p.^.r.Puh..f=q.7c....M..C[.A..Eo.......7..$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\15e4706dadbff920_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2724
                                                                                                                                                                                                                                                      Entropy (8bit):5.914861384986605
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:71BFBAE90D12A968B78890C7E4FF2173
                                                                                                                                                                                                                                                      SHA1:5913B84C69BA2379271570A956E7FAB7D0DFF08E
                                                                                                                                                                                                                                                      SHA-256:CAA6AC95E5256F752062B013CB35444C171A75C1E3387C24C3244930132F5F2F
                                                                                                                                                                                                                                                      SHA-512:6FA1090B5E20447B3C0FBA9E43D21D633D0D81B4B307B672C3245CD3B228B7822A8DC1CB3D3E720145C74559029BBD81D5907E860620381B4CE54A084F5D0EA4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......t...?......_keyhttps://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202410210101/pubads_impl.js .https://shiftntp.com/.A..Eo...................0.p./....................................................q.......6...f.......&.... ...!..."..."..7#...$...%..o%..|&...'...'...'..4(...(.../..60...0..01...1...2..x9..~@..vB..4D...D...F..)G..lI...I...J...O...Q..`S...S...S...T..WT...T..>U...U...V..MY...Y...Y..0^..>`...`..zd...d...f...i...j...k..lr...s...s..2t...x......"...I...l...........l......W..................Q...........,...K......................U.......D...............................%...............8...e...........6...z...........Q...(.......\...............n.......................b...........-...B...m............................!...+..l,...,..H6...<...>..4@..T@...G...I...J...K...K..LK..7L..~L..9N...N...P...|..Q~...~..<...........2...1...m...x...,...........#...........T...............U.......{...h...............D...S...............+...............y.......'.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\1969379497c191ad_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):88688
                                                                                                                                                                                                                                                      Entropy (8bit):6.132847421041414
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:34B7B4947535E76FC7322F1B90A30F18
                                                                                                                                                                                                                                                      SHA1:2A96A8C6AD571A237B18DF3E839D5235F4937832
                                                                                                                                                                                                                                                      SHA-256:B71B22D04A43C924D9B15F8A18590E159657A3D37B9845F7DF8C8D9B762AD212
                                                                                                                                                                                                                                                      SHA-512:4A52D0C2C23E685643F0AF9DBD2024114A0E39C825F68C6F73B9D8AF7027A6F6CC54B3C4FDEAF0D98B3BDCD7F0036B4401911088F9F2BD78760C5CA0ED5949F6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......@...o.P.....B05D0677846017B12E61FED155CBDF5DE0F9218E046C88E41A7073B30DAA43E6...............$....S:....eW......Y...........0T..D...`8.......m.`......L`.....0T......`........`.....).L`.......Sb........`.....a...!...!...a...a...Rb...`....aa........!...Rb..F.....ba....Rb.......ca....a...!..............!...a..........Rb.r......da....Rb.......ea....!...a...!..........a.......!...Rb.......ia....a......Rb........ja....Rb>.......ka...........Rb2.H8....la....RbR.......ma....RbR.......pa....Rb6.jH....oa....Rb^.<.....na....!...RbJ3.n....qa....Rbj.......ta....a...Rb.!fa....sa....Rb2.......fa....Rb"5......ha....................................................................................................................................................................................................I`....Da....xG...0T`.........IaX.........!.. .H......<Q.8B..H-...https://www.google-analytics.com/analytics.js...a........Db........H...D`.....y..Q.`8...........0T.....`........`..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\239cceb8ac752bc0_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2952
                                                                                                                                                                                                                                                      Entropy (8bit):5.771649712752243
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:42AC8CC4B0CD6C9362F8FB282C7403AE
                                                                                                                                                                                                                                                      SHA1:80CF61CEB962B7BFCA8A8CF4B9913588A822FAAA
                                                                                                                                                                                                                                                      SHA-256:AEB1784C4485785D22F560FB916DA9F174E9C6D441BBBE34F8E7D0B29CCA630F
                                                                                                                                                                                                                                                      SHA-512:5989505A694635A5020B727D8FBF2748872E712EA8EE8129422DB0C9673D0940E7292F16BE421C2A02930393A1B343410D6FEB6C78386AF7F0BF1C6D5A7C1412
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......d...B..t...._keyhttps://www.googletagmanager.com/gtag/js?id=G-01ZJWQVL2J&l=dataLayer&cx=c .https://shiftntp.com/.A..Eo..................!S.p./.............................]...^..._...`...a..pa..Gb...b...c..Oe..Rf...g..Mg...g...g...h..=h...h...i...i.. j..Tj...j...j...k.._k...k..Zl...l...m..Km...m...n...o...p...p...p...q...q..~r...s..Ss..<t...u...u..(v...w...x..gy...y...{..7}...}..3~..Z~...~......-...;..........j.............._.......$......................R..................V...........U...........,.......x...w...+...........D...l...D..........]..........................v............................H...S...1...N...............q.......................g.......L.......p...........'...E...........f...*...<.......6..............._.......D.......w.......................-.......W.......'...S...........j...S...............5...........>.......i...1...............)...........e.......2...I...........................k...................!.......e................ ... ...#...#..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\28eb913aa08f7929_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.388629649120409
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A59DB50C559516F088C3BBD801C68636
                                                                                                                                                                                                                                                      SHA1:20BBBBEA9D8BEDF920E8A02C32D4F0664DE8ECAF
                                                                                                                                                                                                                                                      SHA-256:C5DD1F40B5687465DF1F271025A60818A04D00E51A0EA6E1EC6EFFC55FCB7F0D
                                                                                                                                                                                                                                                      SHA-512:66FA320B20331082914A15CD501C359DD0F27D2481F13188CBAE4469CCDC50FAC34A401EAB0F7A8A334DCDF10EE92E645F608F647DBEA742888391D9817A17B4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K.........._keyhttps://cdn.onenews.com/public/_nuxt/BvXFuFJw.js .https://shiftntp.com/.A..Eo....................`p./....................oN.......'..Fq.5.........).2.pX.-..^J.)s.A..Eo.......(.'$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\2b724b4a3325367a_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1388
                                                                                                                                                                                                                                                      Entropy (8bit):5.66609235728122
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:DD6278D14DBBDCA35A8AA9CF6F638195
                                                                                                                                                                                                                                                      SHA1:56483711A2B5099D011EC6305377F9A265918BA1
                                                                                                                                                                                                                                                      SHA-256:AC3AE0C8DA663CF105EF49E63CEF6925B173F980552A3AF74D1E0DE2C86387AB
                                                                                                                                                                                                                                                      SHA-512:2C9143FB6561D47D98D9CF5C6CDAFAE2163D7474E44856EE5ED7833AC167D16C201B574053C93D75FDEB08E65DA62620477AAF4C4D980C9B7212535BC9DF7C24
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......T...Ce.-...._keyhttps://script.hotjar.com/modules.67d7d905831ab88336d0.js .https://shiftntp.com/.A..Eo..................J..p./............................v.......f.......,...................x...........m...T...z......._ ... ..Z!..y2...2..C>..v>...>..!G..IG...G...H...K..:M...`..yf...f..sh...h...i...j..Hn..0y...y..I...............J...}...........t.........................&...V...u......9...K...`...7.............................!...........q.......R...x...................s...........9...p...................8.......:#...1...3...8..-@...F...d.....................F...............N.......................j.......~.......0...................w.......9..............................."...V...........\.......[...........1 ... ... ..7!...!..r"...&..x-...-...-...-......*........2...3..$3..l3..B4..h4...4...4..[5..<9..{9..F<..l<...<..)=..A=..n=...=...B..&D..JE...F...G...L...M..7M...M...N...N..'P...Q..#R..JR...R...S...S...S...T..&T...T...T...U..XU..pU...V...V...V...W...X..y\..@^...m..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\2f8cdaeb6ccbcba2_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.4019904091891044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FFE0D30EB18F9208AA950B9419134E60
                                                                                                                                                                                                                                                      SHA1:EEF264F7EA3E33B151D6121AC627BD2C13AA5A25
                                                                                                                                                                                                                                                      SHA-256:4E62B2D911DE2042717C0E3CE2FC0C86520F896D5F074A4FEF6601F48E435AE9
                                                                                                                                                                                                                                                      SHA-512:D4E69971A3BEF305DEF90E7A68E850850039514F10F1E8B9D2343956500EE3AB1680E52FCF48595EEF0B53D49E45FB3B428A62746D161C3EFC766CFE642ECF46
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K...^i......_keyhttps://cdn.onenews.com/public/_nuxt/CN8p_4sa.js .https://shiftntp.com/.A..Eo....................`p./.....................N......@.D..U.Y&...y.#...2.&g#..}.;...A..Eo.......I..$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\3db352a1dba26740_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):252
                                                                                                                                                                                                                                                      Entropy (8bit):5.8557421185015714
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CDFFB76E932D919370AF46F7DA4BBEEE
                                                                                                                                                                                                                                                      SHA1:B9C105EFBB40EAD87732F42A6423C6A527B6AC6E
                                                                                                                                                                                                                                                      SHA-256:9CBF1F0393824C7BC25D62E8AE5E7B96F1192476419089D9B8753CFB5FD89AE2
                                                                                                                                                                                                                                                      SHA-512:05537D6EA54C63BE841C8E04DEEF7CE2A26D76C33A34E1DD235A7CE3FE87578EF276DA18A7ACF0F19A02C43928C68B3DED9F942BC3CBF802C23A658C85EBA66E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......H....]......_keyhttps://www.google-analytics.com/analytics.js .https://shiftntp.com/.A..Eo.....................p./..Y..B05D0677846017B12E61FED155CBDF5DE0F9218E046C88E41A7073B30DAA43E6...h.B.v...z..`...xq..,a.u.m....A..Eo........#L.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\438df0bf0cadf176_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1579
                                                                                                                                                                                                                                                      Entropy (8bit):5.254669067949082
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3C78F87F3FD591E0B71D5F002FEF3888
                                                                                                                                                                                                                                                      SHA1:87ABF764E5156EEE2246285E8A603010BD3799B9
                                                                                                                                                                                                                                                      SHA-256:DE48FB8F16AF3238194C9F737DCBBDAC74D8EC5A6D22E8827C1B5CAE001FEC52
                                                                                                                                                                                                                                                      SHA-512:F0BEB343673711CC04307A1F5441FCE08AC92757AF7EB1A8C9D4A7DDB87EFDF303D5F0C02D8418EED075048CF96A0025C55721B346E66B31F9E3394EDC71FB51
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......O...{.u....._keyhttps://securepubads.g.doubleclick.net/tag/js/gpt.js .https://shiftntp.com/.A..Eo..................]#.p./.h.................................._.......y...b...................8...........e...................n...}...K ... ..0!..G!..5#...#...%.. %...%...&..V&...&...'...'...)...)..#*...*..=+...+...,...,..)...r..../...2..M3...3...3..'4...4...5..v9...:..);...;...<...<.. =...=..(>..b>...>..-?...?...?..)@..X@...@...F...G..5H...H...I..:I...I...N..XR...R...R...S...T..7U...U../V..iW...X..%Z..F[...[...[.."\..2^..P^..]a...b...c...d...d...e...f..Kf...f...f..vg...g...g...i..Ti..{j...j...m..Xm...m...m.. o...o..Pp..|p...p..Eq..Wr...r...r..ms..0w..rw...w..vy...y...z...{..e{...{..!|..`|...}...~...~.."...R...............3............v.............b.......d.............&.......c......k...........d..........o...........V.......9..........._...]...g...............F...e..........N.....................,...v.......g...#...`...6...............................!............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\4a439cb3f3eea072_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2325
                                                                                                                                                                                                                                                      Entropy (8bit):5.6384678702816835
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E5BA7F91C410BA1C26C5D001F1530D17
                                                                                                                                                                                                                                                      SHA1:CBB8B7F1CAF1E1F14076588CE073D0B27A4BE489
                                                                                                                                                                                                                                                      SHA-256:E58374DBF8DD28DF218ACBF049939CCDD6553F0D7F2E5BA048D43D45B643DD5C
                                                                                                                                                                                                                                                      SHA-512:02EFF448CE6DA025EA77B3E7A31530B4732D89FDF2F23FFBB476A6C8D807A7CF8E83423525D97FEA4F2EC43906D27C4CD9250ACD7CC648CA71D5E78FDD263B5E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......Q....>......_keyhttps://www.googletagmanager.com/gtm.js?id=GTM-WNFNMPW .https://shiftntp.com/.A..Eo...................%.p./.P......................................5...T....................!..."..X#...#...#...#..=$..v$...%...%..Y&...&.."'..H'...'..!(...(...(...)...).. +...+..G,...,..5-...-..........A/.../..u0...1..a2..74..,5...5...5...8..p9...9...:..l:...:...:..f<..t<...>...?...?...@..6@...@...@..]A...A..1B...B..&C...C...C...C...D..RD...D..9E..TE...E...E..2F...F..eG...I...I..QJ...J...J...K...K..dL...L...L...T..}U..WV...V...X..}\..Fe...e...e..`f...f...g..Tg...g...g...h...i...l..5l...l..jo...o...o...p...... ..................................@..........`...~.......c...u......o...T.................}...................4...f...............`.........................E...R...n..........w...>.......j.......2...@...b...;...W...........k.......'...................=...........................7...|.......f.......@.......0...........................>...!...]..........."...W......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\4c7f7b1849963808_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):290
                                                                                                                                                                                                                                                      Entropy (8bit):5.490441714500024
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C9857AFD2427F13168B1E7943622D911
                                                                                                                                                                                                                                                      SHA1:4A1E5BBC0B2B491653831AA3ADD3504B744B18BD
                                                                                                                                                                                                                                                      SHA-256:FBCCA38F1AFD2020FEF488EEF50EAA2CE5456C9E1588EC58A74C1936F1FEFB45
                                                                                                                                                                                                                                                      SHA-512:BCE932343C992ADBE1B44D68B1F2DD23B203D6DAA9AF14FE739C2235EBA29E6AD8922E8D40ADA7CFFD3C184E758B47278707188D32C3C46323DB346ED3425A32
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......Z....n.-...._keyhttps://srm8plmyisn9d7dyn.ay.delivery/manager/sRm8pLMYisn9D7DyN .https://shiftntp.com/.A..Eo.....................p./.T..........................]n...n...n...n...p...q...r..fu..Wv...v...w...x..'~.......... !.C>#.c.'..V-Xk\.....0.p.6....#.A..Eo.......f!.`.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\9da5ee6eb934f719_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):677
                                                                                                                                                                                                                                                      Entropy (8bit):5.217463401260107
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3EE4391507C62B0E3E160D38A26B9727
                                                                                                                                                                                                                                                      SHA1:5CE58DFBC021A6B4901C781F7B92C5764BD145EA
                                                                                                                                                                                                                                                      SHA-256:DF026B5A2347ED8C95F2A8F9603D50E45C10E0D65A9CD9F8577E1CDE9FFDA939
                                                                                                                                                                                                                                                      SHA-512:D59A8F1E741B5198D531CB5D1E69D6DA7F23CECFA949981B3F29A594BC153FD62CD40025BC5A16DEED97D0F6B04B25220D113605FF6C247FA1C4F56FFAF01D46
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......M...c>.r...._keyhttps://srm8plmyisn9d7dyn.ay.delivery/client-v2.js .https://shiftntp.com/.A..Eo....................p./............................x.......^...p...........................W...........i...........I...g...D...d.......?...S#..|$...$..N%..m%...@...N..mQ..RV..E\...\...a...a...b..kc..&d...e...h...k...l...l..rm...m...m...n...n...q...t...u..6v...v...v..Qx..Qy..ry...y...z...z..H{..d{...{...{..P|...|..$}...}...}..(~.........|...1......^...........6...............h......................X...5.......[...........S...i...~.......$...L...a...M!..T0...3...@...C...G...G...G...I...I.............a...f.G....R...cv\..\URGBf.4....o..P.A..Eo.......-..........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\ac7d1e531e15eb97_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2242
                                                                                                                                                                                                                                                      Entropy (8bit):5.65976244272698
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:82307D404ED6DF38165D73B8D2CB46E6
                                                                                                                                                                                                                                                      SHA1:12CAA94174B4AB66092EF41E7E85463C8414A62A
                                                                                                                                                                                                                                                      SHA-256:EC3B2D1866502AD645D91825DB136FE34D6E060C7E920628F0C4077AF1BC463B
                                                                                                                                                                                                                                                      SHA-512:177F7D89C19DF7AA3D922933CBA00BD44F93A7D97A6EC319C0BA343C1272A021081410F3F21111DBF77A6AC2B8EE703EFEC8F653220AAB2AF5F0BA29AA61B120
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......f......$...._keyhttps://www.googletagmanager.com/gtag/js?id=UA-62117061-22&l=dataLayer&cx=c .https://shiftntp.com/.A..Eo...................|.p./....................................|...........W.......z.......6...9 ...!..4!..m!...!...!..$"..."...#...$..;$...$...$..F%...%..A&...&..2'...'...(...)...)...*...*...+...+..e,...,..:-..#..../...0...1...2..N3..{3...5...7...8..A8...8...:..":...;..Q=...=...=...=..F>...>...?...?...?...@...@..9A..oA...A...A...B..=B...B...C..<C..}C...C...E..TG...G...G..3H...H...H..^I...J...J...J..KR..+S...T..kT...V..+Z...b..uc...c..xd...d...e..]e...e...e...f...i...i../j...m..5m..{m..vn..X~...~...~.................3.......W...............,..........M.......#...............F.......+...^..........m.........................:...........Q...:...s......................%......P............................L...z.......0...........m...................G.......+...H.......g.......?...M...................Q...........................s.......5...0...].......L.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\ad3ce3c67c00ad4a_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3428
                                                                                                                                                                                                                                                      Entropy (8bit):5.946041362816844
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C787BC4BC82287DC8E826FD302698745
                                                                                                                                                                                                                                                      SHA1:64267435641D6367C14E93CCBF5C9D33C93887FC
                                                                                                                                                                                                                                                      SHA-256:BAEBE54D666086B41D8C06C41F28E823B9B485474C602EB4631CF72597C7E964
                                                                                                                                                                                                                                                      SHA-512:741429FDD0AB4AB5164E690FF34AEB07CE667A8E0DD6D2ACC69D723665F8024E5285346BBAF9D7C8FA1502E522956C84A2A91061C77FB7887EB0DF8EF06D81A2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......d...aV......_keyhttps://www.googletagmanager.com/gtag/js?id=G-C8QGCBZ3PC&l=dataLayer&cx=c .https://shiftntp.com/.A..Eo...................4.p./............................B...V...3...................1...C...................$...S...........n...=...k...........=.......................M...........W.......9.......U.......S...o.......................F...................2...}.......x...........>...............v...........F...q...........].......A...........L...........&...P...x...........f...............4...........L...............?...Y...................Q....!...!...%..5&..v'...'...*..,+..[+../,..h,...,...-..B-..t-..g.......E/..}1...1...1...2...4...4..25..-6..O;...=...F..IF...F...L..qM...M...M..iN..QO...P..EQ...U..nU...U...V..;V...V...V..mW...W...Y...Y...Y..T[...[...]..A^..k^...^..r_..._...`...a...a...a..$b..`b...b...c...e..ef...i..yl...l...l..Im..[m...p...p..*r...r...r...r..Nu..qu...u...v...w...{..c..........................1.............h...$.......t...........u...........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\b131bea01ec44f19_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.2646849423486595
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D6B8C1E9341FB133AD679B527FF36ABD
                                                                                                                                                                                                                                                      SHA1:076E55025FACFC2D2FEAC044A7395E8164986252
                                                                                                                                                                                                                                                      SHA-256:4E53ACE537D6476A39B52EAB41F5D5C21667ECF41CDECFC3C1227B3DAF5270F7
                                                                                                                                                                                                                                                      SHA-512:3B28CACD55DC714D8348BDB568C222455105EA798984237183477F10CA41571773ED9AF1BF97DD3D26CFEF75B90BFB86497773F4537E39BCBFC9529C903AB737
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K...):(C...._keyhttps://cdn.onenews.com/public/_nuxt/BywsWFWt.js .https://shiftntp.com/.A..Eo..................<.cp./....................oN.......Iu..?.]..'...dmn.W.h..y../....A..Eo..........$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\b4339030576b8ee7_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.427152779115694
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A24857BB4CC952098D80CA9146F6D768
                                                                                                                                                                                                                                                      SHA1:A3386A1FB195E5E0E8C463A0B25F408ABCBD1D7B
                                                                                                                                                                                                                                                      SHA-256:C9354FBA39BABBA78930658A364CE229D6A16A2953C8D774EC16DAA1C4D25E60
                                                                                                                                                                                                                                                      SHA-512:84615CAEC5988886D1033324408E57FFD47A2CAA26BB87C92FB4B2C63E82BA5F564A833803CA8BC874DB9D764BD122A31515CC652E5A312764E81D26B4A4B1BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K...4Y.|...._keyhttps://cdn.onenews.com/public/_nuxt/DVPrM7HS.js .https://shiftntp.com/.A..Eo...................Yap./....................oN......".r{....yH....]........>V.|4|...A..Eo........!P$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\c0db8c3f3c03ed24_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.400596937513151
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:030E1ACF02ADA790EC092164CE43DE34
                                                                                                                                                                                                                                                      SHA1:6EB57975EE5C35C7ED3C7BAC3CF97A0420E0E20F
                                                                                                                                                                                                                                                      SHA-256:5F57B1474C34434067E5C7B5095226BB6566E3727EB28FE6E86BB47BB479E6EF
                                                                                                                                                                                                                                                      SHA-512:BB4E6C91C13423931200D8565A5261FA1371E32CA746589FA48AF7D8D7966378DF77F15EE3F1CAB5E4836669C54A662703658EC5D39E7B79BB1397BD25E5CF5F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K...m......._keyhttps://cdn.onenews.com/public/_nuxt/Da2SryCc.js .https://shiftntp.com/.A..Eo....................`p./....................oN......-.....f#<..m.1.3d?l?.9..%A..._'.A..Eo......8.Gg$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\d35c3e2a3ca098b6_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1813
                                                                                                                                                                                                                                                      Entropy (8bit):5.835114737943904
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:EED7C1E906504332B18532DE29A9C84A
                                                                                                                                                                                                                                                      SHA1:41208347A2F3DFC1A4F1A1E9E2C742A49106A70A
                                                                                                                                                                                                                                                      SHA-256:0D23E039128BC81542DC0E2210A8EB401D1094C5B7D2F3A712A72A448722EFA2
                                                                                                                                                                                                                                                      SHA-512:96FF90038C618E885244D4E9C0623371F4E1755766327A7177E76173B3B2DA56D5282CC756CDB8291F8BBCA32C677EA4ACC26C103922439E5756282C349B4AC9
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m................._keyhttps://srm8plmyisn9d7dyn.ay.delivery/manager-script/sRm8pLMYisn9D7DyN.splitTest.0?v=EFmGHEjENXbs4xWR4 .https://shiftntp.com/.A..Eo.....................p./. ..........................T...................d...|.......u...........Z.......].......m...........D...............-................#...#...%...'...5...8...8..,9..J9..u\...k...l..Xm...m...n.. o........V.......U.......x...........w...............x.......E.../...............<...I...g...R.......$...............^...........I...k...........................!...........................................u...........................%!...#...$...$...$..\&...'...(..x*..U+..n+..L,..B-..S/..c/...>...>...>...?..A@..Z@...B...B..@C..XC...C...C..|F...G..0G..JG..bG...G...G..@H...~..I~..[~...~..N...f...........7.......}...t...C...\...s...........].......).......B...Z...........R...'...............#...)...M...........S...f...............b...........b...............).... ...&...&..C(..Q(..`*..O,..{,...,...,..B-...-......G9.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\d5682428ff5ea407_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.374687447014879
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3504DD245DEA732B776B591535E1B45D
                                                                                                                                                                                                                                                      SHA1:60247C199D8BC318F3AACB6EE0D0F2F4F86F6CFA
                                                                                                                                                                                                                                                      SHA-256:2ABDE5A5C891005B62C5652D54A358846A7D67FAC1A28CAB7418ED0E140B922D
                                                                                                                                                                                                                                                      SHA-512:EECF44334EECFE7C2A3A1E8EC298A5797A7354EDE680B0C7E44DF4C02EA35ABEF343945E5DFD6FED9B881D4F08C445B2A5D39D1993C9C4304468AE38005FFCEB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K....E....._keyhttps://cdn.onenews.com/public/_nuxt/CdLaYYSZ.js .https://shiftntp.com/.A..Eo....................`p./....................oN......H.R......O.e6^...cg..[.wE-vl./..A..Eo........9.$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\dbeb473c1e234f08_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):686
                                                                                                                                                                                                                                                      Entropy (8bit):5.606520841745378
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:69DAA2D18D210D8CD1E287DDA8C6B3ED
                                                                                                                                                                                                                                                      SHA1:07FB1695FA16E9F4FAF21B5444376CAAA025776E
                                                                                                                                                                                                                                                      SHA-256:EC9A99DA325FC9F753960FA7B2FE3CD5298DC9E41122FB2A1D2C89814BC887DB
                                                                                                                                                                                                                                                      SHA-512:2F83BD8AE9A6F645328227CB4C4EE8CFEB0B691367C1685DCCCC46325C2858FD0DFD7A14091477B7991B13CC7C7F884AC6DA01D8BAB8B8ED69A9763663D08395
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......z....P.U...._keyhttps://srm8plmyisn9d7dyn.ay.delivery/manager-script/yield-manager-script-v3.0.16-hotfix.6-prod .https://shiftntp.com/.A..Eo....................p./................................[.......A...T.......%...8...........................J.......L...........n...........................5:...:..J;...;...;...=..0...v...................\.......6.......j...................(...]...q.......................L...\...........O...........6...m........g..b...9...K....../...]................../...v.......E......9...].......j...............$...............6...\........5..:6...7..X8...Z...[...\.."a..@a...b...e..n..3.....@.|.............:.*.A..Eo......&-U.........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\e3e570e8c24616c9_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):215
                                                                                                                                                                                                                                                      Entropy (8bit):5.267819563301631
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3C86B54D7912871A704F2B430DAA33CC
                                                                                                                                                                                                                                                      SHA1:ECB09BA9AB3DD764349CC266267BBA98BF07CCD1
                                                                                                                                                                                                                                                      SHA-256:3836BCDDDD8E79F773A819F80AAFD152290B5091A235E2A43B22FDAE2EE75CA5
                                                                                                                                                                                                                                                      SHA-512:2E286E2130F53C6F4DBD3BF0F894E20699DBC3EEB9FB8AE8EFBCF5E059C364E4F81FE52C54AFD9CE886B02DAFCCEEFAB512016AA504D0617B9E6435C302B375C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m......K...w.p....._keyhttps://cdn.onenews.com/public/_nuxt/CbkbflhZ.js .https://shiftntp.com/.A..Eo..................1|:p./.....................J......!..9_.i(...H.e.....v:......w6..A..Eo..........$.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):576
                                                                                                                                                                                                                                                      Entropy (8bit):5.082053866975404
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4896E2C0BB66FEE12C6624D97F02E220
                                                                                                                                                                                                                                                      SHA1:FA62340051A4761263B88793DE905639EA185C1A
                                                                                                                                                                                                                                                      SHA-256:EECFB05FD7044FDFA12FF7AF6F20263AD18DE08413527CE4F7BAA859C513573E
                                                                                                                                                                                                                                                      SHA-512:C56786530F9A8EA9CC6627B47E47DD9CC80A2EE4E0F9D7FD5B4CB089A20B275E0ECF7E557703093FECC8EBAB07CDD1AA44CC3F7B8D368859E1F5301A8B416ED5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:8......oy retne........................z6%3JKr+...q./.........J..|..<.@!.p./..............7i.@!.p./..\..........=.~.@!.p./.........@g..R.=@!.p./......... ...mp.....p./...........4.n..Z.p./.............S.}.@!.p./.........r...CJ.Z.p./............<*>\.@..p./.............m+..@.np./.........v.....C@..p./..........8.I.{.L...p./............l../@.np./..........kW0.3.@.np./.........$..<?...@.np./...........F..p....^p./..........+u...#...q./..........O....1.@.np./..........O#.<G..Z.p./.........)y..:..(@.np./...........^.($h.@.np./..........5.q./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):576
                                                                                                                                                                                                                                                      Entropy (8bit):5.082053866975404
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4896E2C0BB66FEE12C6624D97F02E220
                                                                                                                                                                                                                                                      SHA1:FA62340051A4761263B88793DE905639EA185C1A
                                                                                                                                                                                                                                                      SHA-256:EECFB05FD7044FDFA12FF7AF6F20263AD18DE08413527CE4F7BAA859C513573E
                                                                                                                                                                                                                                                      SHA-512:C56786530F9A8EA9CC6627B47E47DD9CC80A2EE4E0F9D7FD5B4CB089A20B275E0ECF7E557703093FECC8EBAB07CDD1AA44CC3F7B8D368859E1F5301A8B416ED5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:8......oy retne........................z6%3JKr+...q./.........J..|..<.@!.p./..............7i.@!.p./..\..........=.~.@!.p./.........@g..R.=@!.p./......... ...mp.....p./...........4.n..Z.p./.............S.}.@!.p./.........r...CJ.Z.p./............<*>\.@..p./.............m+..@.np./.........v.....C@..p./..........8.I.{.L...p./............l../@.np./..........kW0.3.@.np./.........$..<?...@.np./...........F..p....^p./..........+u...#...q./..........O....1.@.np./..........O#.<G..Z.p./.........)y..:..(@.np./...........^.($h.@.np./..........5.q./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\js\index-dir\the-real-index~RF60eeb2.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):576
                                                                                                                                                                                                                                                      Entropy (8bit):5.082053866975404
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4896E2C0BB66FEE12C6624D97F02E220
                                                                                                                                                                                                                                                      SHA1:FA62340051A4761263B88793DE905639EA185C1A
                                                                                                                                                                                                                                                      SHA-256:EECFB05FD7044FDFA12FF7AF6F20263AD18DE08413527CE4F7BAA859C513573E
                                                                                                                                                                                                                                                      SHA-512:C56786530F9A8EA9CC6627B47E47DD9CC80A2EE4E0F9D7FD5B4CB089A20B275E0ECF7E557703093FECC8EBAB07CDD1AA44CC3F7B8D368859E1F5301A8B416ED5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:8......oy retne........................z6%3JKr+...q./.........J..|..<.@!.p./..............7i.@!.p./..\..........=.~.@!.p./.........@g..R.=@!.p./......... ...mp.....p./...........4.n..Z.p./.............S.}.@!.p./.........r...CJ.Z.p./............<*>\.@..p./.............m+..@.np./.........v.....C@..p./..........8.I.{.L...p./............l../@.np./..........kW0.3.@.np./.........$..<?...@.np./...........F..p....^p./..........+u...#...q./..........O....1.@.np./..........O#.<G..Z.p./.........)y..:..(@.np./...........^.($h.@.np./..........5.q./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\wasm\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.955557653394731
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C31BD215509E81F042358A2BAD9387B1
                                                                                                                                                                                                                                                      SHA1:E53CBAF819612C79EEDB0CA125B46D1F43D86FAB
                                                                                                                                                                                                                                                      SHA-256:58637A3E677BFE987D1FF1231948BF0BDF7A75F0F97887F1FE6691CC739857A5
                                                                                                                                                                                                                                                      SHA-512:0C83BB9A0057D7C0E403D43BD8596C45C258F72D783FDCEC291E316536B19B04E731B46E4E6D90AA2C3B0C21CF15B7F8CBFB274B2A5A59F854D61F98DA4F87F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(....?.oy retne........................9k.p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.955557653394731
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C31BD215509E81F042358A2BAD9387B1
                                                                                                                                                                                                                                                      SHA1:E53CBAF819612C79EEDB0CA125B46D1F43D86FAB
                                                                                                                                                                                                                                                      SHA-256:58637A3E677BFE987D1FF1231948BF0BDF7A75F0F97887F1FE6691CC739857A5
                                                                                                                                                                                                                                                      SHA-512:0C83BB9A0057D7C0E403D43BD8596C45C258F72D783FDCEC291E316536B19B04E731B46E4E6D90AA2C3B0C21CF15B7F8CBFB274B2A5A59F854D61F98DA4F87F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(....?.oy retne........................9k.p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\webui_js\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\webui_js\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.955557653394731
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46FB7F197FCEFBB64F4BE9D26C6EBBFB
                                                                                                                                                                                                                                                      SHA1:4A628BD71B52E69DD3C8CE6616FFDEC0B28A7219
                                                                                                                                                                                                                                                      SHA-256:7A3693BAE7AB223F940871556E3B2C18111821BDE4033693C7494B3EF520A761
                                                                                                                                                                                                                                                      SHA-512:52ABEBC70E7F12933A76362B11276E2D62F7D74493574B4EB4F01C24A4BD3AF86B27E8F6CE49148DDFD5D8647A0C6B1B489B8588ABFBFA5F8AA02BD862D1AF87
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...Qwc.oy retne........................7..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Code Cache\webui_js\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.955557653394731
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46FB7F197FCEFBB64F4BE9D26C6EBBFB
                                                                                                                                                                                                                                                      SHA1:4A628BD71B52E69DD3C8CE6616FFDEC0B28A7219
                                                                                                                                                                                                                                                      SHA-256:7A3693BAE7AB223F940871556E3B2C18111821BDE4033693C7494B3EF520A761
                                                                                                                                                                                                                                                      SHA-512:52ABEBC70E7F12933A76362B11276E2D62F7D74493574B4EB4F01C24A4BD3AF86B27E8F6CE49148DDFD5D8647A0C6B1B489B8588ABFBFA5F8AA02BD862D1AF87
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...Qwc.oy retne........................7..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DIPS

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):28672
                                                                                                                                                                                                                                                      Entropy (8bit):0.46930631692012015
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:64141419702F081E437CA7B697EEEC39
                                                                                                                                                                                                                                                      SHA1:A7571C8CB6C6F2EE174521E1476A46B0954E45FF
                                                                                                                                                                                                                                                      SHA-256:52B656AA8B53E51A2AB2F678F795CD805A914D7F2C27E38AC40793E8121AE1CF
                                                                                                                                                                                                                                                      SHA-512:452C5BFCBCDEF8275832486A0D01679DC13D6991457058ECCFD070CA5E865F4D9CD203B9091EDF6777248BADA4BA7B3CAE3380493D83777E017E422DFD8CB97A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DNR Extension Rules\mofjdkplmlofiadhjjcacadmghmaglna\aced6ebc-8bc9-4ea3-a092-adfe1bfee777.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):819
                                                                                                                                                                                                                                                      Entropy (8bit):3.315307252039801
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C0890A783D0DD293D8EA5CC93825E8F0
                                                                                                                                                                                                                                                      SHA1:FCFDDB2C16E8A33CF6E2949FF29D79129175382E
                                                                                                                                                                                                                                                      SHA-256:08698A62F4AF864DC26487A5F86A8810C5361616E4A690459DF09A057E760BC8
                                                                                                                                                                                                                                                      SHA-512:34D840579FD4E63A3D3ADF020114782ABDE1487079D2A0672F513129B13B57C4D2842E7971F47A09FE05E1B4E50486D44581B3CAC958DB49300E88E24731ED66
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:---------Version=30....EXTR............................$.......................8...................H...................0............... ...............................................0............... ...................................0...........0............... ...............................$...........H...................0............... ...............................t...............0............... ...........................................................4...............$... ...................................................................................................................shift-version.......122.10.0.1101...................$... ............................... .......................b...^(https://.*(tryshift|shiftium|onenews|shiftntp|shift).com/|http://localhost.*|http://127.0.0.1.*)..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DNR Extension Rules\mofjdkplmlofiadhjjcacadmghmaglna\bfba1032-f28a-4af6-bc7e-14a663a17f0e.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):455
                                                                                                                                                                                                                                                      Entropy (8bit):4.831203813879674
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:990B5A5383616A8E9D5FC7E879E03413
                                                                                                                                                                                                                                                      SHA1:57202B51558088C506FF3569AA43EE96E1488361
                                                                                                                                                                                                                                                      SHA-256:0D8ECE792D36B74AE08669423ABFB1DF175E401475DA40E6E6A67C314F1056FB
                                                                                                                                                                                                                                                      SHA-512:2C5D93ECE1DB8B411E3E47CE2DB3C8394F8A44116F7F46334A59A76263DFDE5A89B3C8AB74993D67FA9F6311F1D3DF123A76397A9CB4408DDC30991548DCDCB2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[{"action":{"requestHeaders":[{"header":"shift-version","operation":"set","value":"122.10.0.1101"}],"type":"modifyHeaders"},"condition":{"regexFilter":"^(https://.*(tryshift|shiftium|onenews|shiftntp|shift).com/|http://localhost.*|http://127.0.0.1.*)","resourceTypes":["main_frame","sub_frame","stylesheet","script","image","font","object","xmlhttprequest","ping","csp_report","media","websocket","webtransport","webbundle","other"]},"id":1,"priority":1}]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DNR Extension Rules\mofjdkplmlofiadhjjcacadmghmaglna\rules.fbs (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):819
                                                                                                                                                                                                                                                      Entropy (8bit):3.315307252039801
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C0890A783D0DD293D8EA5CC93825E8F0
                                                                                                                                                                                                                                                      SHA1:FCFDDB2C16E8A33CF6E2949FF29D79129175382E
                                                                                                                                                                                                                                                      SHA-256:08698A62F4AF864DC26487A5F86A8810C5361616E4A690459DF09A057E760BC8
                                                                                                                                                                                                                                                      SHA-512:34D840579FD4E63A3D3ADF020114782ABDE1487079D2A0672F513129B13B57C4D2842E7971F47A09FE05E1B4E50486D44581B3CAC958DB49300E88E24731ED66
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:---------Version=30....EXTR............................$.......................8...................H...................0............... ...............................................0............... ...................................0...........0............... ...............................$...........H...................0............... ...............................t...............0............... ...........................................................4...............$... ...................................................................................................................shift-version.......122.10.0.1101...................$... ............................... .......................b...^(https://.*(tryshift|shiftium|onenews|shiftntp|shift).com/|http://localhost.*|http://127.0.0.1.*)..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DNR Extension Rules\mofjdkplmlofiadhjjcacadmghmaglna\rules.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):455
                                                                                                                                                                                                                                                      Entropy (8bit):4.831203813879674
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:990B5A5383616A8E9D5FC7E879E03413
                                                                                                                                                                                                                                                      SHA1:57202B51558088C506FF3569AA43EE96E1488361
                                                                                                                                                                                                                                                      SHA-256:0D8ECE792D36B74AE08669423ABFB1DF175E401475DA40E6E6A67C314F1056FB
                                                                                                                                                                                                                                                      SHA-512:2C5D93ECE1DB8B411E3E47CE2DB3C8394F8A44116F7F46334A59A76263DFDE5A89B3C8AB74993D67FA9F6311F1D3DF123A76397A9CB4408DDC30991548DCDCB2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[{"action":{"requestHeaders":[{"header":"shift-version","operation":"set","value":"122.10.0.1101"}],"type":"modifyHeaders"},"condition":{"regexFilter":"^(https://.*(tryshift|shiftium|onenews|shiftntp|shift).com/|http://localhost.*|http://127.0.0.1.*)","resourceTypes":["main_frame","sub_frame","stylesheet","script","image","font","object","xmlhttprequest","ping","csp_report","media","websocket","webtransport","webbundle","other"]},"id":1,"priority":1}]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DawnCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DawnCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DawnCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DawnCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\DawnCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.47693366977411E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:129D92821A923B575FA7E377DEE22EE4
                                                                                                                                                                                                                                                      SHA1:68BD6B9CF9583D0BBF09C4EAAB1514B08ACE0AE3
                                                                                                                                                                                                                                                      SHA-256:E918059253897599C4145FD6C35BF90C1D420EFDD019D23797589F8AF66B7EC7
                                                                                                                                                                                                                                                      SHA-512:E4EB72B5B1D261CF4CF446B1A84E8BDE1F4B5A45A735790B34CCE21E8F8476507C3AD20D6808FC9A711FA4E69767040C271A0AF30C9827E0FA6FC383B9E9F42C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...........................................p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):114
                                                                                                                                                                                                                                                      Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:891A884B9FA2BFF4519F5F56D2A25D62
                                                                                                                                                                                                                                                      SHA1:B54A3C12EE78510CB269FB1D863047DD8F571DEA
                                                                                                                                                                                                                                                      SHA-256:E2610960C3757D1757F206C7B84378EFA22D86DCF161A98096A5F0E56E1A367E
                                                                                                                                                                                                                                                      SHA-512:CD50C3EE4DFB9C4EC051B20DD1E148A5015457EE0C1A29FFF482E62291B32097B07A069DB62951B32F209FD118FD77A46B8E8CC92DA3EAAE6110735D126A90EE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                                                      Entropy (8bit):5.199212463474241
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8C66B0CAA245C8E454D86E946B3B8D7C
                                                                                                                                                                                                                                                      SHA1:AAB8B099B1FBC3431369EB6FE66F42988ED2113A
                                                                                                                                                                                                                                                      SHA-256:6AEDF8B26C1310ADE7207E4888142DB5A2E586BF946B12E6FE724CBA3F5914F8
                                                                                                                                                                                                                                                      SHA-512:4311441DEBCB293853B7151EDD4E7A4C5BFF607EB7C98B0D8AC2650AEBF4EC1298C6A978985DD6C1A34A307B032C50E2744082351BB46CD473FBEF14C3A3348E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:25.883 1e68 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules since it was missing..2024/10/24-14:27:25.942 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Rules\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):57
                                                                                                                                                                                                                                                      Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:41C7D1373DE8E7BD508C548A70910E51
                                                                                                                                                                                                                                                      SHA1:F919499049571C75C7EB73FDAAA5198E6DD641B6
                                                                                                                                                                                                                                                      SHA-256:99C59CBE7DB56D56A286485635E4467004641C6275E708887DD35728EB05109A
                                                                                                                                                                                                                                                      SHA-512:C30CB4EA2478FD816B4A160626B08CB63D2B9DC50EAB694607D44D05117E6AF8DD707BF4E14CF001CF69007A654ADE55149A61ED07F9DE6A9A2EDCB51AFA0773
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.f.5................f.5................f.5...............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):269
                                                                                                                                                                                                                                                      Entropy (8bit):5.1719249306715
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1ED5A66087B36248B730DDED77398ABF
                                                                                                                                                                                                                                                      SHA1:EF6D1DC8ECA19FBEBB985B27C27BEE4B7A7299D0
                                                                                                                                                                                                                                                      SHA-256:EAAAEA93D1502616969C53CC379C24597BBBF08E7C88E267A549EF7FF36AEFD8
                                                                                                                                                                                                                                                      SHA-512:A2F1FCF2CE69BE681C941B1B74CA1E0A1E49EF39070631AADFB0BDFB714C93C03F25E22E120BEE90B5F626D3D0D695932138336D67068346BA82DB46C0888F03
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.364 1e68 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts since it was missing..2024/10/24-14:27:26.390 1e68 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension Scripts\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):171
                                                                                                                                                                                                                                                      Entropy (8bit):1.8784775129881184
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E952942B492DB39A75DD2669B98EBE74
                                                                                                                                                                                                                                                      SHA1:F6C4DEF325DCA0DFEC01759D7D8610837A370176
                                                                                                                                                                                                                                                      SHA-256:14F92B911F9FE774720461EEC5BB4761AE6BFC9445C67E30BF624A8694B4B1DA
                                                                                                                                                                                                                                                      SHA-512:9193E7BBE7EB633367B39513B48EFED11FD457DCED070A8708F8572D0AB248CBFF37254599A6BFB469637E0DCCBCD986347C6B6075C06FAE2AF08387B560DEA0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                                                      Entropy (8bit):5.139822776574509
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CACD779C22FBA19E719A04465EF21E1D
                                                                                                                                                                                                                                                      SHA1:B72DF83B19E2D66E6D00CE855DE57EBB60C9C435
                                                                                                                                                                                                                                                      SHA-256:17C72B6D730B482D6DBC5BDF9AAEFBC16C6A6C2F4EA3D615BEB733EE319774B8
                                                                                                                                                                                                                                                      SHA-512:D00555E2890B5C8A97DDC0AAB7BCD2224EFDE911B9C905F4E938F8B6F96B148B4D7805DEC90018A62A54DE0C574CEEE853409D555733ACAC42DAFF3DDD7A3555
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.492 16f4 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State since it was missing..2024/10/24-14:27:26.534 16f4 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Extension State\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Favicons

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                                                      Entropy (8bit):0.697244829403964
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B40E1BE3D7543B6678720C3AEAF3DEC3
                                                                                                                                                                                                                                                      SHA1:7758593D371B07423BA7CB84F99EBE3416624F56
                                                                                                                                                                                                                                                      SHA-256:2DB221A44885C046A4B116717721B688F9A026C4CAE3A17CF61BA9BEF3AD97F4
                                                                                                                                                                                                                                                      SHA-512:FB0664C1C83043F7C41FD0F1CC0714D81ECD71A07041233FB16FEFEB25A3E182A77AC8AF9910EFF81716B1CCEEE8A7EE84158A564143B0E0D99E00923106CC16
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GCM Store\Encryption\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GCM Store\Encryption\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GCM Store\Encryption\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):275
                                                                                                                                                                                                                                                      Entropy (8bit):5.2379374338684785
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:68F5100E48FCEF380E18AF07279E0649
                                                                                                                                                                                                                                                      SHA1:D7FCF18049A76839A9AD5668E090ADC5D4BE8FC3
                                                                                                                                                                                                                                                      SHA-256:9D3FA92636128B8DD33A2179C8AF85B74BCF4D485FEB3F990BA9655C14101611
                                                                                                                                                                                                                                                      SHA-512:6F4C322C3E9FFC77546CD01FC2C7290EB8B57A8A88D51CB59F083AF10D6F5B94FACD91C9527527038E148016B7A72319C077413CAC23380E7B12032AAD6A375E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:46.693 18d0 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\GCM Store\Encryption since it was missing..2024/10/24-14:27:46.724 18d0 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\GCM Store\Encryption/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GCM Store\Encryption\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GPUCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.05180659495763802
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6F9AB0F019EC0F902655F96ED1F2805A
                                                                                                                                                                                                                                                      SHA1:04335FEED76752EC38326DB15B5EBB13B5E12074
                                                                                                                                                                                                                                                      SHA-256:39173398F1D99893DF644B7FC554CAC9FD333C011A28ADB53B57EC8F6B269F14
                                                                                                                                                                                                                                                      SHA-512:5852ADF8BA4E949C3B1056BA81744D59B794C29EE9855AE3F00DD613F19DF8F8B4879B35568E1D7BC82090E291223D24D2DFF04224DDC4F9E811442128A7F707
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...................................................................?.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GPUCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):0.07412357428911161
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:41FE919FE4298D853C7CD1FA59AD66A1
                                                                                                                                                                                                                                                      SHA1:98E1894DA75BCAEE0144618129611BD8198BD09F
                                                                                                                                                                                                                                                      SHA-256:60FC7258594A06432587034E135D620FB89BF62FF8D1BF00414353C901ED3518
                                                                                                                                                                                                                                                      SHA-512:68F29FA82B503FEC58AF9FD7331ABA36170F04A2106B87F7EB8C6C785FA337CD6DFC7A17E5498FC85283A669CEF80FA99AF95D63CA5313139CDA06D8D7ADAC84
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.................................................................................?......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GPUCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:dBase III DBT, next free block index 3238316739, block length 1024
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1056768
                                                                                                                                                                                                                                                      Entropy (8bit):0.1369643109333083
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E8A3B2E29F7D8B15DE08A8D14AA18548
                                                                                                                                                                                                                                                      SHA1:4F10B36E46E10E4C00F38D61EC4FED862012FC24
                                                                                                                                                                                                                                                      SHA-256:265D21664AA89FC703F04CF60215B78D48CF1BD44AF893DB52A61F4D5007267F
                                                                                                                                                                                                                                                      SHA-512:CA4A6240C7CD59D26DA48A37109FC282BD14566E061B1708D68BB8A44297319033B7B0427B7AEE962F394A00C0B513E682698782BC99CB5F9AE61657C5F87C65
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GPUCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:dBase III DBT, next free block index 3238316739, block length 1024
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4202496
                                                                                                                                                                                                                                                      Entropy (8bit):0.049736404256161396
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1927AA379DCC2FFE5B27F2F7BCA81E5D
                                                                                                                                                                                                                                                      SHA1:5AAA7D3039146A866A9B498988A78F709574DAA2
                                                                                                                                                                                                                                                      SHA-256:F7E97352E2E995B235167C578D623275F594D0BDEA9FD41753F04ADA0D3D3A4D
                                                                                                                                                                                                                                                      SHA-512:28CF40B47A54E51E23CD0EC2BE2C09C3F62AB396FF381AA17C60141FA635D7C675516FA9BD14BE02801D5ED9182E3A5E6CDFC67DA33E2C925119C50EDB3D9EB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:................................................................................?.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\GPUCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2A7F6D540C3B84EAF9822FDEBFCC69E8
                                                                                                                                                                                                                                                      SHA1:95002B5DA6CB1C7EA416A375F9D69B76C9F644BD
                                                                                                                                                                                                                                                      SHA-256:6D838A247326E368B41F7E5F398792D99C0E73C436EF79508B8A4DBF8CE509BB
                                                                                                                                                                                                                                                      SHA-512:87372D759B2386886E5EC1F8038308A2540CEB47D2B03F2F4AD0A41B25344243F518CC7BFE1ABC1DB1343968A67EDF8698531901EA35510383F877EA69A2FD9B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................Q..p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Google Profile.ico (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203079
                                                                                                                                                                                                                                                      Entropy (8bit):6.879026494610918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5224D83245656524F3D6A74CDFB5855A
                                                                                                                                                                                                                                                      SHA1:3B4B6C9F8894978F776BF4A6367B19A923D10981
                                                                                                                                                                                                                                                      SHA-256:29A2BD6511A06E7EA6E797BEB2D93415D80D07F2D6D1773C12FD1E8553D7AE5E
                                                                                                                                                                                                                                                      SHA-512:DFBAC70C0BF0A9058686B193DC5D88CC585DBCCD9537C2DB56E7B63A298F221DE4EF66C018034E80DB5AEC7384FE847A788B77AF495CE6085A18C6C58160EB02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .)....M..(............. ..............................',..-,.v.#.b....$+..NY......33-.55.,3..%&.f...o....KM..`D-.;<..3@..R&..|...m...4&..BM..}7..7E..a/........^...5;..;?..#..]>.........._..x....*3.. ....../......z..r..../"..y..........."-.....f...V...............-......./....Y...|............................................(............. ..................................++Y.((.v !.f...v...DLZ.............02..23..*-.q.'.c...V....7?..OS......5;W.:;../7..4-..L...@..h....09..SP..5W.>?.5A..C3...........O...9C..DH..+.:E..K:...........Y...38..0=..R9......GF.............b...&,..*1..>2.........t;..........j..b.#.r.'..8(.............2W.. .....?...F...V...............W............I...h..............................Z.m...Y...u.......Y..........................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Google Profile.ico~RF603f96.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203079
                                                                                                                                                                                                                                                      Entropy (8bit):6.879026494610918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5224D83245656524F3D6A74CDFB5855A
                                                                                                                                                                                                                                                      SHA1:3B4B6C9F8894978F776BF4A6367B19A923D10981
                                                                                                                                                                                                                                                      SHA-256:29A2BD6511A06E7EA6E797BEB2D93415D80D07F2D6D1773C12FD1E8553D7AE5E
                                                                                                                                                                                                                                                      SHA-512:DFBAC70C0BF0A9058686B193DC5D88CC585DBCCD9537C2DB56E7B63A298F221DE4EF66C018034E80DB5AEC7384FE847A788B77AF495CE6085A18C6C58160EB02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .)....M..(............. ..............................',..-,.v.#.b....$+..NY......33-.55.,3..%&.f...o....KM..`D-.;<..3@..R&..|...m...4&..BM..}7..7E..a/........^...5;..;?..#..]>.........._..x....*3.. ....../......z..r..../"..y..........."-.....f...V...............-......./....Y...|............................................(............. ..................................++Y.((.v !.f...v...DLZ.............02..23..*-.q.'.c...V....7?..OS......5;W.:;../7..4-..L...@..h....09..SP..5W.>?.5A..C3...........O...9C..DH..+.:E..K:...........Y...38..0=..R9......GF.............b...&,..*1..>2.........t;..........j..b.#.r.'..8(.............2W.. .....?...F...V...............W............I...h..............................Z.m...Y...u.......Y..........................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Google Profile.ico~RF604255.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203079
                                                                                                                                                                                                                                                      Entropy (8bit):6.879026494610918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5224D83245656524F3D6A74CDFB5855A
                                                                                                                                                                                                                                                      SHA1:3B4B6C9F8894978F776BF4A6367B19A923D10981
                                                                                                                                                                                                                                                      SHA-256:29A2BD6511A06E7EA6E797BEB2D93415D80D07F2D6D1773C12FD1E8553D7AE5E
                                                                                                                                                                                                                                                      SHA-512:DFBAC70C0BF0A9058686B193DC5D88CC585DBCCD9537C2DB56E7B63A298F221DE4EF66C018034E80DB5AEC7384FE847A788B77AF495CE6085A18C6C58160EB02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .)....M..(............. ..............................',..-,.v.#.b....$+..NY......33-.55.,3..%&.f...o....KM..`D-.;<..3@..R&..|...m...4&..BM..}7..7E..a/........^...5;..;?..#..]>.........._..x....*3.. ....../......z..r..../"..y..........."-.....f...V...............-......./....Y...|............................................(............. ..................................++Y.((.v !.f...v...DLZ.............02..23..*-.q.'.c...V....7?..OS......5;W.:;../7..4-..L...@..h....09..SP..5W.>?.5A..C3...........O...9C..DH..+.:E..K:...........Y...38..0=..R9......GF.............b...&,..*1..>2.........t;..........j..b.#.r.'..8(.............2W.. .....?...F...V...............W............I...h..............................Z.m...Y...u.......Y..........................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\History

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 40, cookie 0x21, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):163840
                                                                                                                                                                                                                                                      Entropy (8bit):0.5406678582572276
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F310CF1FF562AE14449E0167A3E1FE46
                                                                                                                                                                                                                                                      SHA1:85C58AFA9049467031C6C2B17F5C12CA73BB2788
                                                                                                                                                                                                                                                      SHA-256:E187946249CD390A3C1CF5D4E3B0D8F554F9ACDC416BF4E7111FFF217BB08855
                                                                                                                                                                                                                                                      SHA-512:1196371DE08C964268C44103CCAED530BDA6A145DF98E0F480D8EE5AD58CB6FB33CA4C9195A52181FE864726DCF52E6A7A466D693AF0CDA43400A3A7EF125FAD
                                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ .......(...........!......................................................r.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\History-journal

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8720
                                                                                                                                                                                                                                                      Entropy (8bit):0.21949228367239304
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:94A17789D3EC40BF1639F3D57D463F17
                                                                                                                                                                                                                                                      SHA1:98FD62E9CFE9A86EB6E63D657928F2BC4C84DF35
                                                                                                                                                                                                                                                      SHA-256:2914041B7A4A39BE384A83F64FFF045AF89A923CBFDE29B532BF9FCE80F137B5
                                                                                                                                                                                                                                                      SHA-512:89B0641C4633A3F89E24A73A4310D4782DDB2FE89DC35A29F255FEC423B160097670CDD8CC44DC362880C39B9FA6FE5B89B15741E9C5037D7C290A8E0117B255
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.............&....(....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1686267
                                                                                                                                                                                                                                                      Entropy (8bit):4.878418664885502
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6D219120FE485A487E28D12F87F464B5
                                                                                                                                                                                                                                                      SHA1:A43F33E5A8C841BB013CC623AC4B01211BFC6C05
                                                                                                                                                                                                                                                      SHA-256:36C753C12418369406084A37B65F5052B00FC525E228888F57CC29E65C788FD0
                                                                                                                                                                                                                                                      SHA-512:5160664CD4F6BD56CC2BA2384192EAE9F83399104DC074A82D6A83625B766FFE43014A6BC6CEA32772A45D6F3EDB34424F19C094C31DE6100E85FEB067989745
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.2..................Workspacex[{"constructorName":"Workspace","data":{"color":"#c2185b","enableUnreadBadge":true,"id":"primary-workspace","order":0}}]..I^b................AppTypesDirectory.3[{"constructorName":"AppTypesDirectory","data":{"id":"AppTypesDirectory","list":[{"category":"Miscellaneous","colorImageUrl":"https://apps.tryshiftcdn.com/15five/image-color.svg","description":"15Five software elevates the performance and engagement of employees by continuously asking questions and starting the right conversations.","id":"15five","imageUrl":"https://apps.tryshiftcdn.com/15five/image.svg","monochromeImageUrl":"https://apps.tryshiftcdn.com/15five/image-monochrome.svg","name":"15Five","urlOptions":{"allowCustomPath":false,"hasPrefix":false,"urls":["https://my.15five.com"]}},{"category":"Office Administration","colorImageUrl":"https://apps.tryshiftcdn.com/17hats/image-color.svg","description":"17hats is the complete system that helps automate, organize, and optimize small business man

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):337
                                                                                                                                                                                                                                                      Entropy (8bit):5.219180922305854
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2CCBCC7BE2A786B3EC2FF4C5816976DB
                                                                                                                                                                                                                                                      SHA1:0C817E851F8A35CDCDBAAE2EFB907A5613B320AE
                                                                                                                                                                                                                                                      SHA-256:BC6CC65698C5422FBF4D9CA7AF552BDC02CAAD9C5F4F3E47FDFD6DF423D2B31A
                                                                                                                                                                                                                                                      SHA-512:DCEE84419C34EF390E2CE20EE987D981BE2CEB3DDFC4E592A389A1BCCB5DCB67D202D04EC389CE4291B141F67697C82F70DD247EE177F884FCA63C7FDB09ADAC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:32.872 17fc Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna since it was missing..2024/10/24-14:27:32.902 17fc Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local App Settings\mofjdkplmlofiadhjjcacadmghmaglna\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):642
                                                                                                                                                                                                                                                      Entropy (8bit):5.594848721662931
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BA4D5555D7281EC3AB1F5224D23D0770
                                                                                                                                                                                                                                                      SHA1:30D072358589CF23DA160E2953CA63787D8CA520
                                                                                                                                                                                                                                                      SHA-256:749A7FDA8930B9340C2F8AC9D13FF867A5CE02CCBFAD5DD15740A40F9A172D7F
                                                                                                                                                                                                                                                      SHA-512:641B58F252EC57BBCDB99C105CD5DFD1B0E07ACF6F364A2800A9CFEB033DE24222DB6B704D51153A0E9B8D3087507CC913C0E20E5AF0A0531F424D7921B8777A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.G@..................VERSION.1..META:https://shiftntp.com..........[.,_https://shiftntp.com..app:userSelectedTheme..false.$_https://shiftntp.com..iconify-count..0.&_https://shiftntp.com..iconify-version..iconify2.&_https://shiftntp.com..nuxt-color-mode..light.P..w................META:https://shiftntp.com............._https://shiftntp.com..ay_cW.{"pn":1,"u":"fbab00a6-a9a6-4e0e-9097-a40e92d55d87","ra":0.361,"ep":"/g","in":0,"sn":1}.._https://shiftntp.com..ay_s...{"pn":1,"t":1729796258270,"s":1729794458270,"u":"e616a5e8-5399-44b8-8ed4-a48367abc515","ra":0.309,"ep":"/g","in":0,"pr":0,"prs":0}.*_https://shiftntp.com.._hjLocalStorageTest

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):277
                                                                                                                                                                                                                                                      Entropy (8bit):5.153607824033792
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:11E5302DF6F16D164A14A39A5FD104BA
                                                                                                                                                                                                                                                      SHA1:8FF773FE0D9EB7CCE55B4FEC8587E6CD7E9EBD0F
                                                                                                                                                                                                                                                      SHA-256:0777EB3E2C5F0E815B91D995A384772696AED78D797345AF1E7B60EF5C160772
                                                                                                                                                                                                                                                      SHA-512:2B5C930AA3760FBB2FF5BE3CA5F34A887C40EB439F69D9E53CF92F142EA02557CD285285658D7DE93FA2DF69CCD5556AE0DFD23044E76DCB0D6BD0321569BD93
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.901 20a4 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb since it was missing..2024/10/24-14:27:26.964 20a4 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Login Data

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):40960
                                                                                                                                                                                                                                                      Entropy (8bit):0.9213073453245056
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6E7276BB8A07CCFE9E27AAD703FC461C
                                                                                                                                                                                                                                                      SHA1:D5D34ED317A5E4F23C8DC378937BA215B6D1A4B6
                                                                                                                                                                                                                                                      SHA-256:1AEB043B5405D2FCC5D441BCE85A83E05EAC3FE5C6C9E647BC694581539D0753
                                                                                                                                                                                                                                                      SHA-512:44E6235F9E3F9097CB5344786F44AC640B704CED5C2CCBCCE26ECA527DDCD8D56C03A91C840E7A4E5165BA32167540D3B684CC616E658283DCC2A6A0CB35B5AE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Login Data For Account

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):40960
                                                                                                                                                                                                                                                      Entropy (8bit):0.8620857862202844
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A182561A527F929489BF4B8F74F65CD7
                                                                                                                                                                                                                                                      SHA1:8CD6866594759711EA1836E86A5B7CA64EE8911F
                                                                                                                                                                                                                                                      SHA-256:42AAD7886965428A941508B776A666A4450EB658CB90E80FAE1E7457FC71F914
                                                                                                                                                                                                                                                      SHA-512:9BC3BF5A82F6F057E873ADEBD5B7A4C64ADEF966537AB9C565FE7C4BB3582E2E485FF993D5AB8A6002363231958FABD0933B48811371B8C155EAA74592B66558
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network Action Predictor

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 11, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.4027476733482549
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:313A39A57D2AF4E01A8F3894E946C3C0
                                                                                                                                                                                                                                                      SHA1:033D15208677DE395AC2FF2C4536A5A1CECDEAFB
                                                                                                                                                                                                                                                      SHA-256:94837AE9F1FDF961A0CBBBD30C54C6CE28AEC5C0EE7443B4ED2B78896F970109
                                                                                                                                                                                                                                                      SHA-512:FC21CCEAFFE8F9843F55F64C55576A6A2B270ACFD61CADDE56237B4F0F4138365422F06958C9F1352B6D83BC50B39A6F268D75A3514F4BD554ABB7D7AA9E1D30
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......=......\.t.+.>...,...=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\0235b60a-c839-48fd-9d4b-7e4458a7bab4.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\1f3b40ac-727c-428e-9e6e-488e08516762.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4032
                                                                                                                                                                                                                                                      Entropy (8bit):5.301311264250063
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E27EA6E1AF2738AAAD8E555610B33349
                                                                                                                                                                                                                                                      SHA1:304291771AAA9EECE420BB5FE76F0B1F477AAAE9
                                                                                                                                                                                                                                                      SHA-256:F6B2C4B0C81B91BF1507EBBD2EA51B01F486E1B0A5C3E9164A89C90BDB54CBA0
                                                                                                                                                                                                                                                      SHA-512:47A6E34D7EAEF477CBF5DB25D5F50EB51AB9AF59B214B5CED2D4F7945215BDA7C796AB44D296639754B2F8757B9A73B6E609B08EE5DBF8DFB83EAC62A0B4EC2C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://cdn.onenews.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860055281486","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",true],"server":"https://www.googletagmanager.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860055493814","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://content-autofill.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860055494441","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://fonts.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860056552819","port":443,"protocol_str":"quic"}],"anonymization":

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\2ffc2ec5-65dc-4941-a098-07ea100ef911.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\7195d371-d415-48b0-a94f-e85daefbab23.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):520
                                                                                                                                                                                                                                                      Entropy (8bit):5.517469489312833
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1CD82E7758E05E36E58A5E55FC57F0C6
                                                                                                                                                                                                                                                      SHA1:9A9C060FBB34EDE7FF16A855B207CF3657C72EF1
                                                                                                                                                                                                                                                      SHA-256:6D6713C88CA01008D28AA0DD996E87DC83C2F65FFA30C491BFD838D49A759874
                                                                                                                                                                                                                                                      SHA-512:DA28322AFA37590A02FD1351D6A15658DC3E64079C4467E05DF90883BA7FAA6F37248FACCD04AB9DD6F4ED40D8A577E6757AF8DD29FD1B89B791726E55F73E4D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"sts":[{"expiry":1761330461.7339,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794461.733903},{"expiry":1732386459.810201,"host":"Wts4jm11hgqWnWzs/yPPRFW2VRNYQYYyePrAfPpwKDs=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794459.810204},{"expiry":1732386462.461768,"host":"k1gVqIL8e0sWJ8DLw66NXf33I84vrEYipUYOXTusq0c=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794462.461771}],"version":2}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\788b2907-df7c-45f8-b04b-7d2753ffb0cb.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\Cookies

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 7, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                                                      Entropy (8bit):1.4867870188913321
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:45E114FE957125B360A0B7CE5D7B4C68
                                                                                                                                                                                                                                                      SHA1:91EF4F47C6CDC1819BB4426E310E183D678F35F6
                                                                                                                                                                                                                                                      SHA-256:6A2BDD3515A0EBB65BBEB40471E1DA282FC279323F21C2B5ED1ABD3797779BA4
                                                                                                                                                                                                                                                      SHA-512:C9338F16203A65D72D9D9404CDAE3561E4E9FD4634A4DCA598BE43FF2011F2559FD62299FEE2E5F774473F1454C5C411D024CD10D9F17EBFB14006ED8CADB0B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g...C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\Network Persistent State (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\Network Persistent State~RF6155c9.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\Network Persistent State~RF625e5f.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):36864
                                                                                                                                                                                                                                                      Entropy (8bit):1.3921331020238896
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:158A250C5A8C520D890C63B67CC9F177
                                                                                                                                                                                                                                                      SHA1:4ADE15B0B3F1C7E33EDB9E837FEE7556CE15092C
                                                                                                                                                                                                                                                      SHA-256:EE20A32B928530C5DB42E9CB9AF8ED62FDC36A36AF102FD60A9D048481995E31
                                                                                                                                                                                                                                                      SHA-512:F16F2E3E874E6BA4FE5BB31AD4F7822791EF174070C259ED7B5976095007D1C8AD75E6ECFDD3FA32BD405C5343675F99F582A53A477C640B36C0361BE7321051
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\SCT Auditing Pending Reports~RF604013.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\TransportSecurity (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):520
                                                                                                                                                                                                                                                      Entropy (8bit):5.517469489312833
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1CD82E7758E05E36E58A5E55FC57F0C6
                                                                                                                                                                                                                                                      SHA1:9A9C060FBB34EDE7FF16A855B207CF3657C72EF1
                                                                                                                                                                                                                                                      SHA-256:6D6713C88CA01008D28AA0DD996E87DC83C2F65FFA30C491BFD838D49A759874
                                                                                                                                                                                                                                                      SHA-512:DA28322AFA37590A02FD1351D6A15658DC3E64079C4467E05DF90883BA7FAA6F37248FACCD04AB9DD6F4ED40D8A577E6757AF8DD29FD1B89B791726E55F73E4D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"sts":[{"expiry":1761330461.7339,"host":"M4bfUnCmQAi4PNb3B8aI/2+SVJhHKsMfMMT7fzi6ij4=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794461.733903},{"expiry":1732386459.810201,"host":"Wts4jm11hgqWnWzs/yPPRFW2VRNYQYYyePrAfPpwKDs=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794459.810204},{"expiry":1732386462.461768,"host":"k1gVqIL8e0sWJ8DLw66NXf33I84vrEYipUYOXTusq0c=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794462.461771}],"version":2}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\Trust Tokens

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):36864
                                                                                                                                                                                                                                                      Entropy (8bit):0.36497421225202825
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7289D4BDFBD73ED571278F95CB4C1939
                                                                                                                                                                                                                                                      SHA1:7C911F54243D9777A34666F4526A49C7E7AEA244
                                                                                                                                                                                                                                                      SHA-256:2D4CCF8AC8AE4F5C6EC8E0566210FF56585B6BA0290501A1A11ED9B23BFC226E
                                                                                                                                                                                                                                                      SHA-512:6E7D48E18B0317449807C4AC2C377B3CCCF5BD6121077D51152D7E188BA1EA3CF62372B7611036938986DD0C84465DBD747FE8580E3A699F8470229A6D57A749
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Network\b0e0444d-1e38-4f36-b21a-f887cec273fa.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4361
                                                                                                                                                                                                                                                      Entropy (8bit):5.2964940058585785
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0FF781F65F05A406B40078D2B5CED776
                                                                                                                                                                                                                                                      SHA1:41939F9DA7D05A2625BAC6DE8AE50396020FBC6B
                                                                                                                                                                                                                                                      SHA-256:A1CD0C863A2D64406C4F0BFD64439AF25C99927F60FEDD0C694DDCFDD6B9C014
                                                                                                                                                                                                                                                      SHA-512:40C0B9CEDE18A39CA4FC91EA60F0AD4494B7362AD6EFDDB894B4D54288E1EF40BC23DE2AB1C1FF6CB8A24F2EBBB2991B89D44222F047E74BE700CA3215254444
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"http_server_properties":{"servers":[{"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://cdn.onenews.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860055281486","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",true],"server":"https://www.googletagmanager.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860055493814","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://content-autofill.googleapis.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860055494441","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://fonts.googleapis.com"},{"anonymization":["GAAAABQAAABodHRwczovL3NoaWZ0bnRwLmNvbQ==",false],"server":"https://static.hotjar.com","supports_spdy":true},{"anonym

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Preferences (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6170
                                                                                                                                                                                                                                                      Entropy (8bit):4.9046501507448745
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:485EB5F3A7350D6AB274B5BDAD34DD76
                                                                                                                                                                                                                                                      SHA1:B2BA5E50D2121037F96797FC1D22C4E2E561A49A
                                                                                                                                                                                                                                                      SHA-256:3BED34434260F1AA9C860AFD136E1DE7B26CDEFAD1206FED5EBC8F6E19A82D1B
                                                                                                                                                                                                                                                      SHA-512:F6A1425475CF5A6E2EF3FF0F79F90172668C583BD9B177F9C669A3F59993F3E99C2D2136E51E6243A64EBBBF808A73266588E3D5FC11EB7D866590B0C955AD4C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Preferences~RF60945d.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6170
                                                                                                                                                                                                                                                      Entropy (8bit):4.9046501507448745
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:485EB5F3A7350D6AB274B5BDAD34DD76
                                                                                                                                                                                                                                                      SHA1:B2BA5E50D2121037F96797FC1D22C4E2E561A49A
                                                                                                                                                                                                                                                      SHA-256:3BED34434260F1AA9C860AFD136E1DE7B26CDEFAD1206FED5EBC8F6E19A82D1B
                                                                                                                                                                                                                                                      SHA-512:F6A1425475CF5A6E2EF3FF0F79F90172668C583BD9B177F9C669A3F59993F3E99C2D2136E51E6243A64EBBBF808A73266588E3D5FC11EB7D866590B0C955AD4C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Preferences~RF60c7d1.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6170
                                                                                                                                                                                                                                                      Entropy (8bit):4.9046501507448745
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:485EB5F3A7350D6AB274B5BDAD34DD76
                                                                                                                                                                                                                                                      SHA1:B2BA5E50D2121037F96797FC1D22C4E2E561A49A
                                                                                                                                                                                                                                                      SHA-256:3BED34434260F1AA9C860AFD136E1DE7B26CDEFAD1206FED5EBC8F6E19A82D1B
                                                                                                                                                                                                                                                      SHA-512:F6A1425475CF5A6E2EF3FF0F79F90172668C583BD9B177F9C669A3F59993F3E99C2D2136E51E6243A64EBBBF808A73266588E3D5FC11EB7D866590B0C955AD4C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Preferences~RF612b8c.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6170
                                                                                                                                                                                                                                                      Entropy (8bit):4.9046501507448745
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:485EB5F3A7350D6AB274B5BDAD34DD76
                                                                                                                                                                                                                                                      SHA1:B2BA5E50D2121037F96797FC1D22C4E2E561A49A
                                                                                                                                                                                                                                                      SHA-256:3BED34434260F1AA9C860AFD136E1DE7B26CDEFAD1206FED5EBC8F6E19A82D1B
                                                                                                                                                                                                                                                      SHA-512:F6A1425475CF5A6E2EF3FF0F79F90172668C583BD9B177F9C669A3F59993F3E99C2D2136E51E6243A64EBBBF808A73266588E3D5FC11EB7D866590B0C955AD4C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Preferences~RF61a168.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6170
                                                                                                                                                                                                                                                      Entropy (8bit):4.9046501507448745
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:485EB5F3A7350D6AB274B5BDAD34DD76
                                                                                                                                                                                                                                                      SHA1:B2BA5E50D2121037F96797FC1D22C4E2E561A49A
                                                                                                                                                                                                                                                      SHA-256:3BED34434260F1AA9C860AFD136E1DE7B26CDEFAD1206FED5EBC8F6E19A82D1B
                                                                                                                                                                                                                                                      SHA-512:F6A1425475CF5A6E2EF3FF0F79F90172668C583BD9B177F9C669A3F59993F3E99C2D2136E51E6243A64EBBBF808A73266588E3D5FC11EB7D866590B0C955AD4C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\PreferredApps

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):33
                                                                                                                                                                                                                                                      Entropy (8bit):4.051821770808046
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2B432FEF211C69C745ACA86DE4F8E4AB
                                                                                                                                                                                                                                                      SHA1:4B92DA8D4C0188CF2409500ADCD2200444A82FCC
                                                                                                                                                                                                                                                      SHA-256:42B55D126D1E640B1ED7A6BDCB9A46C81DF461FA7E131F4F8C7108C2C61C14DE
                                                                                                                                                                                                                                                      SHA-512:948502DE4DC89A7E9D2E1660451FCD0F44FD3816072924A44F145D821D0363233CC92A377DBA3A0A9F849E3C17B1893070025C369C8120083A622D025FE1EACF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"preferred_apps":[],"version":1}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\README

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):164
                                                                                                                                                                                                                                                      Entropy (8bit):4.258161089029286
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6046856302116D185AC4E47F7697A83B
                                                                                                                                                                                                                                                      SHA1:B154D5B3A660FF33D8CE419E2CC84D361BCC3BB5
                                                                                                                                                                                                                                                      SHA-256:B27214263F2B3A111AEFC3C61F8E2626DFE0CB2778845E5A87BDFADBE9E376B5
                                                                                                                                                                                                                                                      SHA-512:A8F819D187730C54FA7CEE6BEF51336AD5046D9E63D88B4D139A0CC5EE39E103720805DE91BB94163090D7330EDCCA9AD19E94CACD4CE3B8928E24105FBBCB92
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:Shift settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Shift defined APIs.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Safe Browsing Network\Safe Browsing Cookies

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                                                      Entropy (8bit):0.5700841775981857
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A603E09D617FEA7517059B4924B1DF93
                                                                                                                                                                                                                                                      SHA1:31D66E1496E0229C6A312F8BE05DA3F813B3FA9E
                                                                                                                                                                                                                                                      SHA-256:CCD15F9C7A997AE2B5320EA856C7EFC54B5055254D41A443D21A60C39C565CB7
                                                                                                                                                                                                                                                      SHA-512:EADB844A84F8A660C578A2F8E65EBCB9E0B9AB67422BE957F35492FF870825A4B363F96FD1C546EAACFD518F6812FCF57268EF03C149E5B1A7AF145C7100E2CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g...C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Secure Preferences (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6862
                                                                                                                                                                                                                                                      Entropy (8bit):5.613685490733368
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:43F25A84A576092594B0EBCA46779B1E
                                                                                                                                                                                                                                                      SHA1:4258F27127630CCEF2216DD16901D6622DE13A05
                                                                                                                                                                                                                                                      SHA-256:668F2945E5DBE3DA5A167A10DC0578B6BB5B4CD778FC6FA424F9B3B72F84513A
                                                                                                                                                                                                                                                      SHA-512:8C31116B2D98F8CEF0A1ED6C9677A3D4C2ABB67B32FC4DC035F3624332424D7DEEB1872840844FE42BCABB58FEA5E79676C8AD892D36CFD44955FE177A72BE1F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374268045883601","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374268045883601","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Shift.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpG

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Secure Preferences~RF60b12c.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6862
                                                                                                                                                                                                                                                      Entropy (8bit):5.613685490733368
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:43F25A84A576092594B0EBCA46779B1E
                                                                                                                                                                                                                                                      SHA1:4258F27127630CCEF2216DD16901D6622DE13A05
                                                                                                                                                                                                                                                      SHA-256:668F2945E5DBE3DA5A167A10DC0578B6BB5B4CD778FC6FA424F9B3B72F84513A
                                                                                                                                                                                                                                                      SHA-512:8C31116B2D98F8CEF0A1ED6C9677A3D4C2ABB67B32FC4DC035F3624332424D7DEEB1872840844FE42BCABB58FEA5E79676C8AD892D36CFD44955FE177A72BE1F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374268045883601","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374268045883601","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Shift.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpG

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):857
                                                                                                                                                                                                                                                      Entropy (8bit):5.240685786175509
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:97E119EAD22E59F84E58F5821B2D8096
                                                                                                                                                                                                                                                      SHA1:0B85E6B882CACFDB19BD0FA25A62AA17456E1A72
                                                                                                                                                                                                                                                      SHA-256:34C0D89A270C0EACA15D357B54C73B14EDA12EC8A5A298F15F5B2F18858D3B0C
                                                                                                                                                                                                                                                      SHA-512:5788CFC1194BDB3F7432D624A67AABA2A087C2CDFE31BA059B11173ED09CDA07B402D0CDA450C41BFDC4D976B06D45E481C1C6851308EE22F4C30E89A35D901F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:*...#................version.1..namespace-..&f................\.Mc................next-map-id.1.Dnamespace-1721a610_0f89_49bb_97c2_9731e4b2b6f2-https://shiftntp.com/.0.|...................next-map-id.2.fnamespace-1721a610_0f89_49bb_97c2_9731e4b2b6f2-https://www.googletagmanager.com/^0https://shiftntp.com.1..?..................map-0-iconify-count.0...map-0-iconify-version.i.c.o.n.i.f.y.2...map-0-windowActiveTimerT.h.u. .O.c.t. .2.4. .2.0.2.4. .1.4.:.2.7.:.3.3. .G.M.T.-.0.4.0.0. .(.E.a.s.t.e.r.n. .D.a.y.l.i.g.h.t. .T.i.m.e.).0#.f.................next-map-id.3.`namespace-1721a610_0f89_49bb_97c2_9731e4b2b6f2-https://td.doubleclick.net/^0https://shiftntp.com.2..#+)................map-0-_hjSessionStorageTest..E.................next-map-id.4.lnamespace-1721a610_0f89_49bb_97c2_9731e4b2b6f2-https://securepubads.g.doubleclick.net/^0https://shiftntp.com.3

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                                                      Entropy (8bit):5.114162463475331
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5F21D712E3D0273DFA4A1980671E1CDD
                                                                                                                                                                                                                                                      SHA1:B73A41189720DDA8DCEAC81B17D6FD073A94A882
                                                                                                                                                                                                                                                      SHA-256:59AB23B6283FC2F4EC9B45ACE9C4722FA256894F32295AEE5FB9A62E9109267D
                                                                                                                                                                                                                                                      SHA-512:455FED8DE340650A3BD0789268766431B5502EF1C7B02C7B6A727B8594134692520E0E330FD99D1D79E42E3FA9B355DFA7CB6970046696EC6D0DD7DD71A2ABE7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:27.544 119c Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage since it was missing..2024/10/24-14:27:27.599 119c Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Session Storage\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Sessions\Session_13374268048342523

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16185
                                                                                                                                                                                                                                                      Entropy (8bit):3.209246151966985
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:EFF4284DF81280B1E1D574E217279D5D
                                                                                                                                                                                                                                                      SHA1:4E89EE22E6AAACF7448917F1AD4DF73802E32A02
                                                                                                                                                                                                                                                      SHA-256:BF7849A0F89C86DD942E4CBDF2CB3E7A41F11F11FF9C1B514CF89C3A8ED71150
                                                                                                                                                                                                                                                      SHA-512:AE79A36DEFDCC7862829194C0097CA6C093BEBD70104A9DEE2C258AB206CAFAA1D68DF025ADD3D97A905DBD1E15F9DA4E2B18FFC908840F38C3F947607AD6582
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SNSS..........?..............?..............?...... ...?..........?......?..........................?..........?....!.....?..................................?...?1..,......?$...1721a610_0f89_49bb_97c2_9731e4b2b6f2......?..........?.....g.p./.......?.............................?..............?........chrome://newtab/....N.e.w. .T.a.b...d...`...!...X.....................................................................................................'=%....'=%..................................h...............................................4.......h.t.t.p.s.:././.s.h.i.f.t.n.t.p...c.o.m./.g.....................................8.......0.......8....................................................................... .......................................................P...$...6.8.8.9.4.a.3.e.-.6.f.d.0.-.4.a.6.8.-.8.d.5.d.-.a.4.6.c.f.0.d.e.6.c.9.3.................P...$...3.e.c.9.6.b.0.c.-.3.6.2.7.-.4.0.1.3.-.8.7.4.4.-.3.5.4.f.8.f.4.b.2.0.f.9.....................https://shiftntp.com/g/..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Shared Dictionary\cache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Shared Dictionary\cache\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A6C746E279D699C3FBBC45F58148AD2C
                                                                                                                                                                                                                                                      SHA1:C22054F8429BCBC49E5DF187F9DBA07B3CADF4E1
                                                                                                                                                                                                                                                      SHA-256:DD04E27FE8F75CFE905FF2B034F82FEF220CEB3EEAA4CA58105EF9106FD90000
                                                                                                                                                                                                                                                      SHA-512:493C0A8D70CC2CEDB116EAC3177ACEB6B353281DEA9BA8C019CB37347652F4A4EB67A38AD53D156EA9571B0CE9162E745238CE8B29B9E4171E03F842FAD88AD8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...ZHk.oy retne........................R..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A6C746E279D699C3FBBC45F58148AD2C
                                                                                                                                                                                                                                                      SHA1:C22054F8429BCBC49E5DF187F9DBA07B3CADF4E1
                                                                                                                                                                                                                                                      SHA-256:DD04E27FE8F75CFE905FF2B034F82FEF220CEB3EEAA4CA58105EF9106FD90000
                                                                                                                                                                                                                                                      SHA-512:493C0A8D70CC2CEDB116EAC3177ACEB6B353281DEA9BA8C019CB37347652F4A4EB67A38AD53D156EA9571B0CE9162E745238CE8B29B9E4171E03F842FAD88AD8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...ZHk.oy retne........................R..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Shared Dictionary\db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 9, database pages 11, cookie 0x8, schema 4, UTF-8, version-valid-for 9
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.4080312020123944
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:71CCDDA9F3186C8E729BB559F93BB992
                                                                                                                                                                                                                                                      SHA1:3712C11BB21B8E2A74BB879D47B2819ED1AC14A8
                                                                                                                                                                                                                                                      SHA-256:79B107307408E5AD9A145C87533316174FD13F4AD943497D079522FBE325B3B1
                                                                                                                                                                                                                                                      SHA-512:19F8134FCD1211964111B07884B52878B1649644B6EC623BB586DF1A9B7DABC7F8C8A755D2A52C908B563BDD968135F4F703CC35103696E40D0AB0020C8DC4BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....~.........Z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Shortcuts

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                                                      Entropy (8bit):0.4416736849685617
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0DFE52D674DA36B942DEBAF5357C66E9
                                                                                                                                                                                                                                                      SHA1:CF6E444369BB89A0AC82BF6285708AAC414E9137
                                                                                                                                                                                                                                                      SHA-256:FA08B6EBEC333B2D11EFF9CD6B5EA3E0B48BFF020F168FC5183B69B532988F4C
                                                                                                                                                                                                                                                      SHA-512:43C3AE45717D6AB0477CD531757287F7A133BE3B360E1AFE42F44737B6850D361974E931D71DFA68E717486A35CCA143B63962FE4F803190D225E015E4D90901
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):40
                                                                                                                                                                                                                                                      Entropy (8bit):3.473726825238924
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:148079685E25097536785F4536AF014B
                                                                                                                                                                                                                                                      SHA1:C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
                                                                                                                                                                                                                                                      SHA-256:F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
                                                                                                                                                                                                                                                      SHA-512:C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.On.!................database_metadata.1

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):291
                                                                                                                                                                                                                                                      Entropy (8bit):5.048989446787109
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:190749DCD9D87748365502A0588FF2B2
                                                                                                                                                                                                                                                      SHA1:38902CB1D79C4E448ED9131454481582EDC0ED69
                                                                                                                                                                                                                                                      SHA-256:46CA074BF7D8F1814B4701861A1A5B617BA78424BA197F79EE075DEFB05A0D01
                                                                                                                                                                                                                                                      SHA-512:54E8CC9DE1AE808A30753140A578E55A8074F66A649D7F8C42546DF143ECD0E4C839D196AD2420449A520DE855AA55071ABDF4C24E5CE8001D4F5FDE40FF25B5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:25.841 fd4 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database since it was missing..2024/10/24-14:27:25.881 fd4 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Site Characteristics Database\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.02033137211929502
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A6B2D697136A84F03929F775EE719DD0
                                                                                                                                                                                                                                                      SHA1:9EBC240757D3752CD9877E946FA9FECB93BF55D3
                                                                                                                                                                                                                                                      SHA-256:DC8EBC22375F68E79C378F01017B8B1CF00AA0DAB39DA8D131A6B6BFB3771372
                                                                                                                                                                                                                                                      SHA-512:4C835CED0B568B0DB1793C99BCE4F32A03478467B20ECD53737444C8D6100CAF77415A99CC6E7138495C1DCFC2EB008AF12F82FE0289FF15DB543549B4A1D3CB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):0.021215139518959727
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A2160549F5CE59E9BD962C8052A19976
                                                                                                                                                                                                                                                      SHA1:334B55BF41694352C5AF384191F2190D124E5085
                                                                                                                                                                                                                                                      SHA-256:5B12ABC90FEE62B0CA4637081A07E7C460A8FC7F4734D1188556D1BD71FC4C7A
                                                                                                                                                                                                                                                      SHA-512:4D5260EDE5B2230ECF4DD175481FEDBFB8FA19C07AE965849AB9434EB99B1A12B689A5BC07103E63AEA43A36EDA396E14B51BED4AD2C2AA6F77BF0733B262E97
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4202496
                                                                                                                                                                                                                                                      Entropy (8bit):0.03412296073393731
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2934C3732C3F2C881106BCFFE3D41F04
                                                                                                                                                                                                                                                      SHA1:EA524E631CD74CD70537A4C90DC4B46E94CE7895
                                                                                                                                                                                                                                                      SHA-256:55662EF03A6CC41EC9F0CA14F24C1C542992D469B1EEC9E1CCC594E625A56C3E
                                                                                                                                                                                                                                                      SHA-512:B92DA911B838E54FA33AB709354DF95DA3169C5A311DACB7E1811B86A69A111D8ED06F70CB8513FBB3C7C618733E7764ACCAB916C0CF177DCA454D7BFF6162CD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data\f_000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):137277
                                                                                                                                                                                                                                                      Entropy (8bit):7.996453587243322
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:ACD58759A6AFB44EFAC14D1D83957C2A
                                                                                                                                                                                                                                                      SHA1:B1FAB0D95CE05D21E6CA4B8F861115C9A939C863
                                                                                                                                                                                                                                                      SHA-256:6692F913D2A39C2D5899B52AB19CA08B8D1D568900A9BE0AD8307F69DBABCFF6
                                                                                                                                                                                                                                                      SHA-512:930E53517DD55F1E7D6CB61E19B68B6D47AF69CFFE736B6B5382CD828BC4552353D69B7F7AD3E4DD83CC1B888D8073AD49CBC26A4347E0F50A05330A03F3645D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.'!DT.z..!..~........@.1......5.7BR....._M.=...M..36e..g.F.n.V{.J.?I?....M;...1......Q......J@rd:.2f.k.[..=.H..w..]x....".x|H.(Q..M..>.R..*<x.W'..%.J....T..>..F,....mU.A....Y.9|....=.m&..Y..zI3.Y.P .+J.sr.-...Whq..1.8........F...o./.....Q..I.hh..(.}h........X.....D...z._....5b.O~.C...x.....-.g...#v.{.S]..3.]..d.u..w{..!m.....'.<B.o&.._Mo.]......0g.RSA.b..8=.V(........bT..6....#....r..]......c...p....)iE..?...8...]..{9...>.G#C.m..1&..8.....t...I4.....E.f.,$......:O...b..l..8Kv..j>.....J2.#.0...'|....D...Qz.e.tr9.E.=..#....3.}..".~eN .*.U........R.....R)J..3.Cp..~.)E......qu........q...t.x.>.O.c1.E..._......y...D...<-M...Z..[.UH.V..u...]...s.ob......).I..............B.!^e....YS..LYX.$.a.].i.._".v.....Z't.....:a.[.........!.........0..#..t.~H3._..HY.(..r..|..9.1}*...e..@N./......#'6x../..J.....-~(.!.F..-m%.`.....4.%I.''.UXDW..)._.E.......F..M.:+o+H.D.L...a.'f.c.n.U...n.|...n>\+.._.Q...lCa.F&/.:..88.......z....Cv?.Zv.V.3[.A..a.eW=..n...b

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Cache\Cache_Data\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):524656
                                                                                                                                                                                                                                                      Entropy (8bit):5.027445846313988E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4F5B1BF83D0AE6EE7DDD6DEAE80C0029
                                                                                                                                                                                                                                                      SHA1:9C285A4C7790D0106BA8431CFA3440BB24E2F4C3
                                                                                                                                                                                                                                                      SHA-256:72D71F55F6F86AF993CDED5258CBFAD9C6D544116DCA0F1A3551A5D6CD63A075
                                                                                                                                                                                                                                                      SHA-512:AB941F2A28A4FD9A3764E848876EA27BD3611DCCF24A0376882AE52F1788AB9544B0EA83807DA4A51F3EEDA8B959A03A8FF66F2F5EA7786CCC00175D27902B61
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................?f.p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\js\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\js\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F4F8AA12B615BF80FF356B16793E2D88
                                                                                                                                                                                                                                                      SHA1:E79615851BC60A0F54D5AE7622C367FCC68DBF8F
                                                                                                                                                                                                                                                      SHA-256:0490C74C5D3A7220C2F2BF86B67B2E42BCCBE1EB8F0E02D96445C934C0546D34
                                                                                                                                                                                                                                                      SHA-512:1DF933EBC19098E9F493117918DE7EB1AFAFED78E925407A9D6D359DC76C090C6EB1C04697D3F2AD5E8776FE923F3CB6B72170055DC961A5460E68C1B6B2BBBE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(.....oy retne........................u..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\js\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F4F8AA12B615BF80FF356B16793E2D88
                                                                                                                                                                                                                                                      SHA1:E79615851BC60A0F54D5AE7622C367FCC68DBF8F
                                                                                                                                                                                                                                                      SHA-256:0490C74C5D3A7220C2F2BF86B67B2E42BCCBE1EB8F0E02D96445C934C0546D34
                                                                                                                                                                                                                                                      SHA-512:1DF933EBC19098E9F493117918DE7EB1AFAFED78E925407A9D6D359DC76C090C6EB1C04697D3F2AD5E8776FE923F3CB6B72170055DC961A5460E68C1B6B2BBBE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(.....oy retne........................u..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\wasm\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\wasm\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F4F8AA12B615BF80FF356B16793E2D88
                                                                                                                                                                                                                                                      SHA1:E79615851BC60A0F54D5AE7622C367FCC68DBF8F
                                                                                                                                                                                                                                                      SHA-256:0490C74C5D3A7220C2F2BF86B67B2E42BCCBE1EB8F0E02D96445C934C0546D34
                                                                                                                                                                                                                                                      SHA-512:1DF933EBC19098E9F493117918DE7EB1AFAFED78E925407A9D6D359DC76C090C6EB1C04697D3F2AD5E8776FE923F3CB6B72170055DC961A5460E68C1B6B2BBBE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(.....oy retne........................u..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\wasm\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F4F8AA12B615BF80FF356B16793E2D88
                                                                                                                                                                                                                                                      SHA1:E79615851BC60A0F54D5AE7622C367FCC68DBF8F
                                                                                                                                                                                                                                                      SHA-256:0490C74C5D3A7220C2F2BF86B67B2E42BCCBE1EB8F0E02D96445C934C0546D34
                                                                                                                                                                                                                                                      SHA-512:1DF933EBC19098E9F493117918DE7EB1AFAFED78E925407A9D6D359DC76C090C6EB1C04697D3F2AD5E8776FE923F3CB6B72170055DC961A5460E68C1B6B2BBBE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(.....oy retne........................u..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\webui_js\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\webui_js\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.939830830432992
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3A0FE4E7FAB0DEBBE1957038E0BC208B
                                                                                                                                                                                                                                                      SHA1:6835F2C5DFBF63D9D8EFB06362413F88C6012D87
                                                                                                                                                                                                                                                      SHA-256:0504641172884DBF999D2F8766AA998636A0B7F2926A435F285715FB7312D63D
                                                                                                                                                                                                                                                      SHA-512:2536FD2E50E937C867E80130ACE42A384A02036B5E404598A4A07CEC67B69061FC89F1AF3A8B0FBB0F0311CBEC8FAAE41B10F1F8A0E92165981D419D6C71718F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...0.T.oy retne........................e".p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Code Cache\webui_js\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.939830830432992
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3A0FE4E7FAB0DEBBE1957038E0BC208B
                                                                                                                                                                                                                                                      SHA1:6835F2C5DFBF63D9D8EFB06362413F88C6012D87
                                                                                                                                                                                                                                                      SHA-256:0504641172884DBF999D2F8766AA998636A0B7F2926A435F285715FB7312D63D
                                                                                                                                                                                                                                                      SHA-512:2536FD2E50E937C867E80130ACE42A384A02036B5E404598A4A07CEC67B69061FC89F1AF3A8B0FBB0F0311CBEC8FAAE41B10F1F8A0E92165981D419D6C71718F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...0.T.oy retne........................e".p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\DawnCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\DawnCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\DawnCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\DawnCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\DawnCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:735325539BFD35EEA0CA9D337866308F
                                                                                                                                                                                                                                                      SHA1:DFAFB1F35860BDB33C5EF9B670FA2A5FC7433780
                                                                                                                                                                                                                                                      SHA-256:3FB0AA1624F0567A83D96375117E463DCC7F6530C4417B72BBE6347A2C8F41F8
                                                                                                                                                                                                                                                      SHA-512:D0CF392D1D36A09EA42CCD4FC07DC6015CE87732F2DC25A0400F85BC807B683031B548A51816265EA7420F250BC57E5454D389A12027BBCBEC6EDE483DE9FBDD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................6J.p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\GPUCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.14072053252330394
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:80FC068C1942393D7FEAA61B6DFA9C4B
                                                                                                                                                                                                                                                      SHA1:37C0740A976BDDB7B8B25932A34173557968EEEF
                                                                                                                                                                                                                                                      SHA-256:C509C2499999A1C926578E3D024F7F901DAF61D6962714A6D10B51759466B20F
                                                                                                                                                                                                                                                      SHA-512:5124F3BBA1095B4D562DA1EA3632043D0A4078F71B2F37FF6A5053A27F5B86A23A96BB082A6334AB29CC8C30B08307549348E2E544C687D3D5BF7CC9F2E6BF8A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\GPUCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):0.19910068269127068
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:90C44EE18C36BC1505B6B1E5053BD15A
                                                                                                                                                                                                                                                      SHA1:A2D89E8AC7643FF271866105051FB71F0B8F1C0D
                                                                                                                                                                                                                                                      SHA-256:CD63A697FB3DC917D165422D95C11916F1D287AFE584F73C806C22B825ABB267
                                                                                                                                                                                                                                                      SHA-512:CCB5CB1051A0E6DAD4236D6A1D9680A35A5EEAED1CC7215080A5FCA974C78DB87324C9B5556F138DF50185D85C392BB668C96CF4C40E2D0CED3DDF797D492251
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....................................................................................?...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\GPUCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1056768
                                                                                                                                                                                                                                                      Entropy (8bit):0.3541824243194949
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:85917A431325410373B28FBCB87DA30F
                                                                                                                                                                                                                                                      SHA1:013793E27B440C0C03AB7641C534331EBFC99B4B
                                                                                                                                                                                                                                                      SHA-256:4019C147B3A7C9AF63872670FA28062BC02610BAD57B158114C8516457574ABF
                                                                                                                                                                                                                                                      SHA-512:E4C720FF0F13C75B14DA8BCE4BF5A3237D6C05063BF3E39880ADC74E754FAB48D1F0E48C1728B5348B7BF2093AA438E55BECAB0532FA2E5FCED551C367EA02EE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..................................................................................w.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\GPUCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4202496
                                                                                                                                                                                                                                                      Entropy (8bit):0.16454219102401255
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B0257AC1F0ED64521E8206F9A549F879
                                                                                                                                                                                                                                                      SHA1:794C132D626E774DC903412A66E81D9E271D331E
                                                                                                                                                                                                                                                      SHA-256:62CF4FDBDDB7FB4C57A9B1948C2C3381B635746065309B296FE948E7D186ED28
                                                                                                                                                                                                                                                      SHA-512:7FB7DB2976E3857F3033E2AB75B9DDD94E5193F698F8A3ED4B5B69FA2C4EB112781797C745885115160BB4C957C47B0F914520485D4785A9EED0B00A764EFF1E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\GPUCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:AC79C650397E8AA6CB30F9236A9EEC75
                                                                                                                                                                                                                                                      SHA1:AE30ED74092F34F02C43E3D2FD2956D2C53F1648
                                                                                                                                                                                                                                                      SHA-256:EA20D3859FB373D47EAC0A4A25A3655BB4B567BB003BC2A66132424FADAC6F6F
                                                                                                                                                                                                                                                      SHA-512:B0D8F5D6CE6524C83AF3B29315F957CA6FE6EE4751923D7AB79F0ABC0F547D9FF7770F55FF029A0CE991A230457D381BFC7C57D44A1BB2DDFDBF511EEA50A4E3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...........................................p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.blob\1\00\2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):856916
                                                                                                                                                                                                                                                      Entropy (8bit):5.133107551831812
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46E55923ED027CE8FC8950BB13C196AE
                                                                                                                                                                                                                                                      SHA1:3540F53BE920378A6EE971B66D046D116962B290
                                                                                                                                                                                                                                                      SHA-256:01E75B9AD07831C8D5D099CD0F8BF4571A2749FA593D3BC058910ACE4BD9498D
                                                                                                                                                                                                                                                      SHA-512:F4C2F12FC8902B00EA546F9D6C612D587613D16AB50B7475D7226FB90068A09EA43A3282480001FE1A5F7B3150C3205C829739CAA922B1DCB40233D56D8BDDB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.................A..o".name".Microsoft Word".description"`Microsoft Word lets you create, edit, view, and share your files with others quickly and easily.".category".Office Administration".disallow_webview_mutingF".urlo".urlsA."'https://office.live.com/start/Word.aspx$..".has_prefixF".allow_custom_pathF{.".unreado".versionI.".type".number".selectorsA.".label[for="O365_MainLink_Bell"]$..".regexo".pattern".(\d+)".matchIndexI.{.{.".supported_mailbox_typesA.".office365".outlook$..".id".microsoft-word".image_url"5https://apps.tryshiftcdn.com/microsoft-word/image.svg".color_image_url";https://apps.tryshiftcdn.com/microsoft-word/image-color.svg".monochrome_image_url"@https://apps.tryshiftcdn.com/microsoft-word/image-monochrome.svg{.o".name".Employment Hero".description"jThe smarter way to manage HR, people, payroll and productivity. For small and medium businesses on the up.".category".Legal and HR".urlo".urlsA.".https://employmenthero.com/$..{.".id".employmenthero".image_url"5https://apps.tr

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2277
                                                                                                                                                                                                                                                      Entropy (8bit):4.1275135474209605
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2CEE4DD3F3B1E2292E4B1028C7DBA8B0
                                                                                                                                                                                                                                                      SHA1:482DE8E9A76CCDDDF72970FE80D2DC1F8FED4F17
                                                                                                                                                                                                                                                      SHA-256:C421E2C7F591FB4C9919402ED6398DE2EA32114AFA14FF9209B7D20544BA0477
                                                                                                                                                                                                                                                      SHA-512:2FD74B77EAA0FEEE109292FA6AEFBD4570ED612D582DFCC386C947A8539F9FF8E99CD7070A4CF55FA8D2AE5611782B0B03E25027B5558ED81305890B7C517B55
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:. ......................2.......".....................................\N................................5.c.h.r.o.m.e.-.e.x.t.e.n.s.i.o.n._.m.o.f.j.d.k.p.l.m.l.o.f.i.a.d.h.j.j.c.a.c.a.d.m.g.h.m.a.g.l.n.a._.0.@.1..k.e.y.v.a.l.-.s.t.o.r.e.....................4..P.............................2.........keyval-store......2.........................g...............................2....k.e.y.v.a.l......2............2..........2..........2..........2..........2..........2.............k.e.y.v.a.l........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................k.e.y.v.a.l...... .................2.................2.................2.................2.................2.................2.................2.................2.................2..............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):491
                                                                                                                                                                                                                                                      Entropy (8bit):5.2236582905784426
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:98395FF606C509FC568122D482CF1968
                                                                                                                                                                                                                                                      SHA1:A595C6B6F26AD305CA32C47481C2E249FCD48694
                                                                                                                                                                                                                                                      SHA-256:57E269681E3DC8794BEA2847F88191F10201ADC15736196F659F738013FC3BB8
                                                                                                                                                                                                                                                      SHA-512:C500DB14C4DD9E2E11E68C27F5FFCA3B5FD69D9CDE6580875B06C83E8CDE5196A9B9B880760F209F81B66D040FDB9789A17E4E56C066F32DC4CA9529DC563500
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:34.008 17fc Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb since it was missing..2024/10/24-14:27:34.053 17fc Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\IndexedDB\chrome-extension_mofjdkplmlofiadhjjcacadmghmaglna_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):23
                                                                                                                                                                                                                                                      Entropy (8bit):4.142914673354254
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3FD11FF447C1EE23538DC4D9724427A3
                                                                                                                                                                                                                                                      SHA1:1335E6F71CC4E3CF7025233523B4760F8893E9C9
                                                                                                                                                                                                                                                      SHA-256:720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
                                                                                                                                                                                                                                                      SHA-512:10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........idb_cmp1......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Local Storage\leveldb\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Local Storage\leveldb\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Local Storage\leveldb\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):375
                                                                                                                                                                                                                                                      Entropy (8bit):5.212460528485928
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E87D397BB07E906F77B5ED81F9503EB0
                                                                                                                                                                                                                                                      SHA1:73BB9A76004AE2CB771966300AE1199F6DD3B475
                                                                                                                                                                                                                                                      SHA-256:AE126E5350CCFFE5A2BC678ABC6605612C93697E9F408EE2995FD8E3E90F4980
                                                                                                                                                                                                                                                      SHA-512:8503A1C1DD94536535242952BEAB7A8ED83E018274290DC15B14468146E914B9292F7A36D88A16C84E5535DE85E719D168D57E9B13A7A4B2EEB1283E24999847
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.914 119c Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Local Storage\leveldb since it was missing..2024/10/24-14:27:26.969 119c Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Local Storage\leveldb/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Local Storage\leveldb\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\09d58a0e-e38f-434a-b026-e4ecfaac42d9.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\11df8cce-ac4e-40b3-8efd-098539e5b011.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):188
                                                                                                                                                                                                                                                      Entropy (8bit):5.379880704254513
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E6B9D2B38660767EFCDFC7162E59808E
                                                                                                                                                                                                                                                      SHA1:D4CEA7D2E20C275AD0A7876D2EFC523AF32B305D
                                                                                                                                                                                                                                                      SHA-256:E737E85D654CE397EB71BD526DDF6B09E5995E24A1CC352181B8EF28148AC675
                                                                                                                                                                                                                                                      SHA-512:DBFAD08FD4B5B00C6201A63958F6F4838414179244AA39D1AE2B860E692B36A63B7631402ED8FD4F60C88CAEF43A0545FB2FBD577A21F0C1059A5B2B8B718D14
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"sts":[{"expiry":1761330466.633558,"host":"Cmm0TPV8IFHzG1RMAzzV0+m2QunpOHvsPTvycC7RxAc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794466.633562}],"version":2}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\3ace1f6f-7c50-4a17-bfc8-735f0570dbc3.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):793
                                                                                                                                                                                                                                                      Entropy (8bit):5.389389757172249
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0B011B87618B02E77EB433CB8C21B6F5
                                                                                                                                                                                                                                                      SHA1:165D6BFCF824678944B29D4BA30F2CC97C6E891A
                                                                                                                                                                                                                                                      SHA-256:B54ACCCDCDDE9F0299796CD914D5F5BCA1641090B06AD5760D61D61EE5B6F881
                                                                                                                                                                                                                                                      SHA-512:2936D3951644037DC4541731025CA9B3DFA307E93290562F55816D5CA3E72FBBB80701DDB6F7D780C1303993B3285EA721627C40D3CB2DA45FDFC1AF0A055E71
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376860066633347","port":443,"protocol_str":"quic"}],"anonymization":["OAAAADMAAABjaHJvbWUtZXh0ZW5zaW9uOi8vbW9mamRrcGxtbG9maWFkaGpqY2FjYWRtZ2htYWdsbmEA",false],"network_stats":{"srtt":96133},"server":"https://o1334372.ingest.sentry.io"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374354466875607","port":443,"protocol_str":"quic"}],"anonymization":["OAAAADMAAABjaHJvbWUtZXh0ZW5zaW9uOi8vbW9mamRrcGxtbG9maWFkaGpqY2FjYWRtZ2htYWdsbmEA",false],"network_stats":{"srtt":98181},"server":"https://apps.tryshiftcdn.com","supports_spdy":true}],"supports_quic":{"address":"192.168.11.20","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\Cookies

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                                                      Entropy (8bit):0.5700841775981857
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A603E09D617FEA7517059B4924B1DF93
                                                                                                                                                                                                                                                      SHA1:31D66E1496E0229C6A312F8BE05DA3F813B3FA9E
                                                                                                                                                                                                                                                      SHA-256:CCD15F9C7A997AE2B5320EA856C7EFC54B5055254D41A443D21A60C39C565CB7
                                                                                                                                                                                                                                                      SHA-512:EADB844A84F8A660C578A2F8E65EBCB9E0B9AB67422BE957F35492FF870825A4B363F96FD1C546EAACFD518F6812FCF57268EF03C149E5B1A7AF145C7100E2CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g...C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\Network Persistent State (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\Network Persistent State~RF618a46.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):59
                                                                                                                                                                                                                                                      Entropy (8bit):4.619434150836742
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2800881C775077E1C4B6E06BF4676DE4
                                                                                                                                                                                                                                                      SHA1:2873631068C8B3B9495638C865915BE822442C8B
                                                                                                                                                                                                                                                      SHA-256:226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
                                                                                                                                                                                                                                                      SHA-512:E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\Reporting and NEL

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):36864
                                                                                                                                                                                                                                                      Entropy (8bit):0.5557578422469297
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5F080B35A2352F916D574E049FFA88C5
                                                                                                                                                                                                                                                      SHA1:BB4CDB42EA2C454BCB92FAC028696D65B4B91697
                                                                                                                                                                                                                                                      SHA-256:10CE46995378459151B5A072D6EF1E54867CE57EDCC1520EC6A0965B5FF432FF
                                                                                                                                                                                                                                                      SHA-512:B9862A5BA6723D3859BB1BAECC04DF0BF14A3D6C06278FD7CFBBBA2412FD0DC5DCECA969A9E1FE967A8F29764CB800F475B3270F3D1C2868F56A2D1586125BEA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\SCT Auditing Pending Reports~RF604061.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\TransportSecurity (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):188
                                                                                                                                                                                                                                                      Entropy (8bit):5.379880704254513
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E6B9D2B38660767EFCDFC7162E59808E
                                                                                                                                                                                                                                                      SHA1:D4CEA7D2E20C275AD0A7876D2EFC523AF32B305D
                                                                                                                                                                                                                                                      SHA-256:E737E85D654CE397EB71BD526DDF6B09E5995E24A1CC352181B8EF28148AC675
                                                                                                                                                                                                                                                      SHA-512:DBFAD08FD4B5B00C6201A63958F6F4838414179244AA39D1AE2B860E692B36A63B7631402ED8FD4F60C88CAEF43A0545FB2FBD577A21F0C1059A5B2B8B718D14
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"sts":[{"expiry":1761330466.633558,"host":"Cmm0TPV8IFHzG1RMAzzV0+m2QunpOHvsPTvycC7RxAc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1729794466.633562}],"version":2}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\Trust Tokens

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):36864
                                                                                                                                                                                                                                                      Entropy (8bit):0.36497421225202825
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7289D4BDFBD73ED571278F95CB4C1939
                                                                                                                                                                                                                                                      SHA1:7C911F54243D9777A34666F4526A49C7E7AEA244
                                                                                                                                                                                                                                                      SHA-256:2D4CCF8AC8AE4F5C6EC8E0566210FF56585B6BA0290501A1A11ED9B23BFC226E
                                                                                                                                                                                                                                                      SHA-512:6E7D48E18B0317449807C4AC2C377B3CCCF5BD6121077D51152D7E188BA1EA3CF62372B7611036938986DD0C84465DBD747FE8580E3A699F8470229A6D57A749
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\a9a285eb-cfe3-438a-8257-cacf85801930.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Network\e9d17050-a1df-42cb-aafe-e8a502a11864.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2
                                                                                                                                                                                                                                                      Entropy (8bit):1.0
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                                                                                                      SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                                                                                                      SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                                                                                                      SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1347
                                                                                                                                                                                                                                                      Entropy (8bit):6.048038560939419
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C59EAA40B92EAB5EEFA79A0C71B2F7D5
                                                                                                                                                                                                                                                      SHA1:38B1BD0C96069AB137E2CF462806C00B1AC870BB
                                                                                                                                                                                                                                                      SHA-256:DA6DCA38C4637EBE3E8B00C61E678CBFF762A59F8012EEED9BDE63436D2D9286
                                                                                                                                                                                                                                                      SHA-512:FD530BA22731712FA9A25BE4E7758479A8BAF38022BEFD8FF6D38758451A76845B01B667753E2807ADAC679309C57235E56709A057043BA25A8DB4F6B2E66F17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"..x2................URES:1...INITDATA_NEXT_RESOURCE_ID.2S..p................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.KINITDATA_UNIQUE_ORIGIN:chrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/..:REG:chrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/.0.....4chrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/.Echrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/service-worker.js .(.0.8......@..#Z.b.....trueh.h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h."h."p.x..............................REGID_TO_ORIGIN:04chrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/..RES:0.1.....Schrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/assets/hydrateStore-DmGfJwXx.js..#"@A36216CC55CC98690A05010FC1ACF0B0E1382B042948AB0EAD9948AC3AB148A1..URES:1..PRES:1..RES:0.0.....Echrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/service-worker.js..."@0F53329EF7FE58915FED9CE1D6D6A51079A04DD31AFD090AA213BB3E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):379
                                                                                                                                                                                                                                                      Entropy (8bit):5.212677664370566
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:425747C992804E9C3F885F2BC00C5757
                                                                                                                                                                                                                                                      SHA1:0B6E690D4D81757B06862460E8D11974703E4CEE
                                                                                                                                                                                                                                                      SHA-256:8835485D83B05EC3942DBB5D90F1F887599AEF5A46C216BEB7A65AFC17D0BA99
                                                                                                                                                                                                                                                      SHA-512:CDE4C2663486173616A9820D59EEA96E1AE2BE9C8D9DFF81136BE6E88B429EC0F8BBD19EC52B44F81C9BCA49802917BCCE1342F18F364689DC5E4CFCF77EA198
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.454 1d40 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database since it was missing..2024/10/24-14:27:26.534 1d40 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3851
                                                                                                                                                                                                                                                      Entropy (8bit):5.444212378634472
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3FC3DEF0F376CE6C23CF841C47B9C364
                                                                                                                                                                                                                                                      SHA1:67D9A35885F80F09E263908469B37B35E03E909C
                                                                                                                                                                                                                                                      SHA-256:09ABBA6907F9895ADB2E2F8442043FB00C95570FBAD4773E0DEE6FC639EC6E9E
                                                                                                                                                                                                                                                      SHA-512:3517F4CBC1EE25F4B113B20C3676BB83D5E5F40C713D1665AB5B91465C07BF0339D927ACBD8534BED906AA1BB93C11F75DC3AA3BE4FD2372FE413C266E141B46
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..........rSG.....0var S=Object.defineProperty;var s=(e,t)=>S(e,"name",{value:t,configurable:!0});import{f as u,L as l,z as y,t as w,i as d,S as T,Z as F,j as b,a as L,b as C,c as D,d as E,Y as R,_ as v}from"./assets/hydrateStore-DmGfJwXx.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="c90a698c-3d21-47ca-a21b-7aeb54879ef1",e._sentryDebugIdIdentifier="sentry-dbid-c90a698c-3d21-47ca-a21b-7aeb54879ef1")}catch{}})();const x=1e4,I="normal";function h(){const e=u(),t=new l(h);return new Promise((i,o)=>{let r=!1,a;const c=s(n=>{clearTimeout(a),r||(r=!0,i(n))},"clearResolve"),f=s(n=>{clearTimeout(a),r||(r=!0,o(n))},"clearReject"),p=s(n=>{n.type===I&&(e.windows.onCreated.removeListener(p),c(n))},"onWindowCreated");e.windows.onCreated.addListener(p),e.windows.getAll({windowTypes:[I]},n=>{if(n.length>0){const[g]=n;if(!g){f(new Error("No window found"));re

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\4cb013792b196a35_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):575940
                                                                                                                                                                                                                                                      Entropy (8bit):5.394820327998459
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8299A35304A385AE1E01455FC2FF1700
                                                                                                                                                                                                                                                      SHA1:FA3563E48A1CF19E4B44FC7D025C81F5A530D542
                                                                                                                                                                                                                                                      SHA-256:022E25690CFB6F75ED9DCBC05E5339444ED276F6CE5565855A9A9EEB788E641B
                                                                                                                                                                                                                                                      SHA-512:7E81EABB2D492AC6980C9B409E5B459546653FC449110E6C9F21A9951F8BBF565A16921CBA641A92D189474673172632220FCE367EB9FCD4C91D60CB571F2990
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..........V.......1var $A=Object.defineProperty;var s=(e,t)=>$A(e,"name",{value:t,configurable:!0});(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="4452d9ef-1f0d-4e98-8dd1-8ce3e8bee91a",e._sentryDebugIdIdentifier="sentry-dbid-4452d9ef-1f0d-4e98-8dd1-8ce3e8bee91a")}catch{}})();var FA=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};FA.SENTRY_RELEASE={id:"122.10.0"};var Hi=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function jA(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}s(jA,"getDefaultExportFromCjs");var Dv={exports:{}},De={};/**. * @license React. * react.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in th

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):96
                                                                                                                                                                                                                                                      Entropy (8bit):3.6466479170272463
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9F2497FDC19550D8496459E864A370E2
                                                                                                                                                                                                                                                      SHA1:866A61CFF9CF5C3DFCF21CD5DD427358A3A8A132
                                                                                                                                                                                                                                                      SHA-256:2E3057AAA1290B4866F93534FD4723FD3C243CC2417578E1114C9FF7C17BC362
                                                                                                                                                                                                                                                      SHA-512:88F6CA191C09E393BEE909E1301621F429B36C7021278C9E0E8FCF92BE3C422E6938B08FC8B3940A358461DABE67EE0DB70EF0932E8E3D76845AFAE4251AC4C4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:X....=..oy retne........................5j.+y..L$................X....,<.................p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):96
                                                                                                                                                                                                                                                      Entropy (8bit):3.6466479170272463
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9F2497FDC19550D8496459E864A370E2
                                                                                                                                                                                                                                                      SHA1:866A61CFF9CF5C3DFCF21CD5DD427358A3A8A132
                                                                                                                                                                                                                                                      SHA-256:2E3057AAA1290B4866F93534FD4723FD3C243CC2417578E1114C9FF7C17BC362
                                                                                                                                                                                                                                                      SHA-512:88F6CA191C09E393BEE909E1301621F429B36C7021278C9E0E8FCF92BE3C422E6938B08FC8B3940A358461DABE67EE0DB70EF0932E8E3D76845AFAE4251AC4C4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:X....=..oy retne........................5j.+y..L$................X....,<.................p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Service Worker\ScriptCache\index-dir\the-real-index~RF609382.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):96
                                                                                                                                                                                                                                                      Entropy (8bit):3.6466479170272463
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9F2497FDC19550D8496459E864A370E2
                                                                                                                                                                                                                                                      SHA1:866A61CFF9CF5C3DFCF21CD5DD427358A3A8A132
                                                                                                                                                                                                                                                      SHA-256:2E3057AAA1290B4866F93534FD4723FD3C243CC2417578E1114C9FF7C17BC362
                                                                                                                                                                                                                                                      SHA-512:88F6CA191C09E393BEE909E1301621F429B36C7021278C9E0E8FCF92BE3C422E6938B08FC8B3940A358461DABE67EE0DB70EF0932E8E3D76845AFAE4251AC4C4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:X....=..oy retne........................5j.+y..L$................X....,<.................p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                                                      Size (bytes):1085
                                                                                                                                                                                                                                                      Entropy (8bit):4.233778845796945
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:502E85609B7E08448756BB1225056D94
                                                                                                                                                                                                                                                      SHA1:04D8ED0068329D79C0E7C4F6B0C59417BDB21EB2
                                                                                                                                                                                                                                                      SHA-256:B8AE17A1D12B9679D87FFC59ADBF17AB80F444433671896886434E5BF4FC8595
                                                                                                                                                                                                                                                      SHA-512:54C5D48D635C387C3C8ECDBD20CFBA988FAAFD8BCB5E1485245A5146F2887C7609ACDF38FB3FBFA61D3D765710A3B55EC6870BD2E79E5602FD97963AA9E380A8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:*...#................version.1..namespace-?-...................next-map-id.1.cnamespace-485214fe_d223_4f0b_961f_28a2982790fa-chrome-extension://mofjdkplmlofiadhjjcacadmghmaglna/.0 .G.'................map-0-sentryReplaySession..{.".i.d.".:.".0.8.a.0.b.9.0.c.f.1.8.2.4.3.7.7.8.3.9.c.c.b.5.5.e.1.3.8.2.3.7.c.".,.".s.t.a.r.t.e.d.".:.1.7.2.9.7.9.4.4.6.1.6.2.2.,.".l.a.s.t.A.c.t.i.v.i.t.y.".:.1.7.2.9.7.9.4.4.6.1.5.0.7.,.".s.e.g.m.e.n.t.I.d.".:.0.,.".s.a.m.p.l.e.d.".:.".b.u.f.f.e.r.".}.....'................map-0-sentryReplaySession..{.".i.d.".:.".0.8.a.0.b.9.0.c.f.1.8.2.4.3.7.7.8.3.9.c.c.b.5.5.e.1.3.8.2.3.7.c.".,.".s.t.a.r.t.e.d.".:.1.7.2.9.7.9.4.5.2.5.1.2.7.,.".l.a.s.t.A.c.t.i.v.i.t.y.".:.1.7.2.9.7.9.4.4.6.1.5.0.7.,.".s.e.g.m.e.n.t.I.d.".:.0.,.".s.a.m.p.l.e.d.".:.".b.u.f.f.e.r.".}.....'................map-0-sentryReplaySession..{.".i.d.".:.".0.8.a.0.b.9.0.c.f.1.8.2.4.3.7.7.8.3.9.c.c.b.5.5.e.1.3.8.2.3.7.c.".,.".s.t.a.r.t.e.d.".:.1.7.2.9.7.9.4.5.8.9.3.2.2.,.".l.a.s.t.A.c.t.i.v.i.t.y.".:.1.7.2.9.7

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):363
                                                                                                                                                                                                                                                      Entropy (8bit):5.174806368664782
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:298DC051E2C834A748311093F5439BD7
                                                                                                                                                                                                                                                      SHA1:306B5A89CC645CEBE7303362780FF5F9510F5641
                                                                                                                                                                                                                                                      SHA-256:F4335A6172D2D1CA8A6245BA121E229C136CE849B8F388290DE6A8F3DB5E4ACB
                                                                                                                                                                                                                                                      SHA-512:9D5DF0237DA8BA1AB3C108766A2B2325106C4BE0775E275D6DAAE19780BDA8A307C5E48D94E57430CB922F66D07B66DF62667BD14D88179DB73E6EB0321FA83D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:41.464 119c Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage since it was missing..2024/10/24-14:27:41.504 119c Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Session Storage\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Shared Dictionary\cache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24
                                                                                                                                                                                                                                                      Entropy (8bit):2.1431558784658327
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                                                                                                      SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                                                                                                      SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                                                                                                      SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:0\r..m..................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Shared Dictionary\cache\index-dir\temp-index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:68B6554636810DA7121F6B1F86488606
                                                                                                                                                                                                                                                      SHA1:0B26A94E6A5102B46F71951C7E17023A3708E4C4
                                                                                                                                                                                                                                                      SHA-256:83BC66A4C9056974B9D563C62D64B03FB2D4674D34667BA02C66BE7D6AA3F265
                                                                                                                                                                                                                                                      SHA-512:7EA005F469A3EACB69355013AC25F894A10CB48B46D42C5D6BD64B4C97074E522E809A9EC70DA7F58CF80FC5F5DE8EC1E17E99280A26BAA92906B5111A28B474
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...%.Zsoy retne........................|..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Shared Dictionary\cache\index-dir\the-real-index (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):48
                                                                                                                                                                                                                                                      Entropy (8bit):2.9972243200613975
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:68B6554636810DA7121F6B1F86488606
                                                                                                                                                                                                                                                      SHA1:0B26A94E6A5102B46F71951C7E17023A3708E4C4
                                                                                                                                                                                                                                                      SHA-256:83BC66A4C9056974B9D563C62D64B03FB2D4674D34667BA02C66BE7D6AA3F265
                                                                                                                                                                                                                                                      SHA-512:7EA005F469A3EACB69355013AC25F894A10CB48B46D42C5D6BD64B4C97074E522E809A9EC70DA7F58CF80FC5F5DE8EC1E17E99280A26BAA92906B5111A28B474
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:(...%.Zsoy retne........................|..p./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\Shared Dictionary\db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 9, database pages 11, cookie 0x8, schema 4, UTF-8, version-valid-for 9
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.4080312020123944
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:71CCDDA9F3186C8E729BB559F93BB992
                                                                                                                                                                                                                                                      SHA1:3712C11BB21B8E2A74BB879D47B2819ED1AC14A8
                                                                                                                                                                                                                                                      SHA-256:79B107307408E5AD9A145C87533316174FD13F4AD943497D079522FBE325B3B1
                                                                                                                                                                                                                                                      SHA-512:19F8134FCD1211964111B07884B52878B1649644B6EC623BB586DF1A9B7DABC7F8C8A755D2A52C908B563BDD968135F4F703CC35103696E40D0AB0020C8DC4BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....~.........Z..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\WebStorage\QuotaManager

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):40960
                                                                                                                                                                                                                                                      Entropy (8bit):0.49254363418992186
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3A14DAADE69954AEF4C5271A6305AFC2
                                                                                                                                                                                                                                                      SHA1:B5DC9BD498B6ED026B2D6D5A1AE15A19460280B0
                                                                                                                                                                                                                                                      SHA-256:C51464DC80A6E6248157EE508A29D5BF5B22393603FE8D55674D124F6A155E14
                                                                                                                                                                                                                                                      SHA-512:E11E2FA65D26758BC71123FF1C9F95D33A7494B15B93F648C1520FF001EB8FD9C42E40ED09E6AB16B2686C3C18E5A1B63F55470715FA2BA0524C0D54A027A4C3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Storage\ext\mofjdkplmlofiadhjjcacadmghmaglna\def\databases\Databases.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):28672
                                                                                                                                                                                                                                                      Entropy (8bit):0.3407587842954347
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:315332044706528A5FE8A6DDE075F0B3
                                                                                                                                                                                                                                                      SHA1:00AFB7AD87D6B357F2AB8D7717A67951A2A9F0AA
                                                                                                                                                                                                                                                      SHA-256:05CF19B9848E82CA48587087B680AD6E5BF0C898E9505125E3B6EF46F7371D75
                                                                                                                                                                                                                                                      SHA-512:6E8553AB19864090437B9C006832A704CD3AFDE129AF4B272598CA0E1DA81E473AED4ADD82F857BFCE30042924FE6072958E766D7154C8D70CE0BA8AB6744FE6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):46
                                                                                                                                                                                                                                                      Entropy (8bit):4.019797536844534
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:90881C9C26F29FCA29815A08BA858544
                                                                                                                                                                                                                                                      SHA1:06FEE974987B91D82C2839A4BB12991FA99E1BDD
                                                                                                                                                                                                                                                      SHA-256:A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
                                                                                                                                                                                                                                                      SHA-512:15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...n'................_mts_schema_descriptor...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):269
                                                                                                                                                                                                                                                      Entropy (8bit):5.177521775962761
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E473C64625B8FA88ADC2815A7801508A
                                                                                                                                                                                                                                                      SHA1:D7944D1AC8D441A2724265E403EFB832717B9FFF
                                                                                                                                                                                                                                                      SHA-256:B74F7DF1E250C48DA33C938DF8AA399D4C2C44A18911935262BD357FED0EF139
                                                                                                                                                                                                                                                      SHA-512:16859223CCFA293A8A0BB3D0E9A6BEFAD5520AA9A0DFBD6F54E0218910EEE2D23A633A4530EC7CEAC8F3C4DD67272E97E562CB8229CEFE025D8BBC6B51932E3E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:25.822 16f4 Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB since it was missing..2024/10/24-14:27:25.880 16f4 Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Sync Data\LevelDB\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Top Sites

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                                                      Entropy (8bit):0.3717750985067839
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:986962EFD2BE05909F2AADED39B753A6
                                                                                                                                                                                                                                                      SHA1:657924EDA5B9473C70CC359D06B6CA731F6A1170
                                                                                                                                                                                                                                                      SHA-256:D5DDDBB1FBB6BBF2F59B9D8E4347A31B6915F3529713CD39C0E0096CEA4C4889
                                                                                                                                                                                                                                                      SHA-512:E2F086F59C154EA8A30CA4FA9768A9C2EB29C0DC2FE9A6ED688839853D90A190475A072B6F7435FC4A1B7BC361895086D3071967384A7C366CE77C6771B70308
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Visited Links

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):131072
                                                                                                                                                                                                                                                      Entropy (8bit):0.002110589502647469
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BAB8B3251C1110F35396668D1913F284
                                                                                                                                                                                                                                                      SHA1:4FFCF75DCEB833CC71630412891D2CED444EE41A
                                                                                                                                                                                                                                                      SHA-256:4473473718E6D05DC91375880C52D2773C1CC9EA87E538F1225507FE2A56CDD3
                                                                                                                                                                                                                                                      SHA-512:217EAF6E3484AB875EABD0CD616FAB91EBA1A92047E49F3BBD858C6ACE348F3F2C0BF1BF7FC86C6F77A0C819FB3FCD79178F174CFE4D1FEDEBEF3BEC61CF50FC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:VLnk.....?.........e.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\Web Data

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, page size 2048, file counter 3, database pages 64, cookie 0x26, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):131072
                                                                                                                                                                                                                                                      Entropy (8bit):1.1344889700792518
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7883D1BFE1669F5F233E2A103C57AD3E
                                                                                                                                                                                                                                                      SHA1:E95CDDCC9458A057F20E7F0204C5F0561689551A
                                                                                                                                                                                                                                                      SHA-256:432014DD7A7BCFA693C3A414CBF5AF1CBE5C249D3E6AA7B7737868510C23C6F1
                                                                                                                                                                                                                                                      SHA-512:CEA831DB972039A68CC072DEA2A7A689C6CA0D3FE00E936DEF367B3447A21BA67CCC9555154619BA2437AAA3E63293C85E1F445BE4A50208FAAF447A54737DFF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ .......@...........&......................................................r............;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\WebStorage\QuotaManager

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):40960
                                                                                                                                                                                                                                                      Entropy (8bit):0.4122151792245538
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:51DC6E4E72141CDF6395F2E2C5E46D09
                                                                                                                                                                                                                                                      SHA1:6D1555FE001110F4FFE5FFDF817E5E135003A6A5
                                                                                                                                                                                                                                                      SHA-256:BB0F49900678DC650FA4A6A67DC1A9CEF176A1C3B447B97DE0A978EF936F9C88
                                                                                                                                                                                                                                                      SHA-512:0E76A2AB0D261E76F2C201F481273E4C943955BD43B1396D374B0F9C6C930483DB4DA250FE1744AAB5060A63DFA9BE11A5207D9AD5E440668065D386AC484F39
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\a0348736-1271-4231-8734-bc5e9b8b51fb.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6862
                                                                                                                                                                                                                                                      Entropy (8bit):5.613685490733368
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:43F25A84A576092594B0EBCA46779B1E
                                                                                                                                                                                                                                                      SHA1:4258F27127630CCEF2216DD16901D6622DE13A05
                                                                                                                                                                                                                                                      SHA-256:668F2945E5DBE3DA5A167A10DC0578B6BB5B4CD778FC6FA424F9B3B72F84513A
                                                                                                                                                                                                                                                      SHA-512:8C31116B2D98F8CEF0A1ED6C9677A3D4C2ABB67B32FC4DC035F3624332424D7DEEB1872840844FE42BCABB58FEA5E79676C8AD892D36CFD44955FE177A72BE1F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374268045883601","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374268045883601","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Shift.","icons":{"128":"webstore_icon_128.png","16":"webstore_icon_16.png"},"key":"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCtl3tO0osjuzRsf6xtD2SKxPlTfuoy7AWoObysitBPvH5fE1NaAA1/2JkPWkVDhdLBWLaIBPYeXbzlHp3y4Vv/4XG+aN5qFE3z+1RU/NqkzVYHtIpVScf3DjTYtKVL66mzVGijSoAIwbFCC3LpG

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\d1d159b0-f233-4768-9a07-a1e76abac65f.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203079
                                                                                                                                                                                                                                                      Entropy (8bit):6.879026494610918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5224D83245656524F3D6A74CDFB5855A
                                                                                                                                                                                                                                                      SHA1:3B4B6C9F8894978F776BF4A6367B19A923D10981
                                                                                                                                                                                                                                                      SHA-256:29A2BD6511A06E7EA6E797BEB2D93415D80D07F2D6D1773C12FD1E8553D7AE5E
                                                                                                                                                                                                                                                      SHA-512:DFBAC70C0BF0A9058686B193DC5D88CC585DBCCD9537C2DB56E7B63A298F221DE4EF66C018034E80DB5AEC7384FE847A788B77AF495CE6085A18C6C58160EB02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .)....M..(............. ..............................',..-,.v.#.b....$+..NY......33-.55.,3..%&.f...o....KM..`D-.;<..3@..R&..|...m...4&..BM..}7..7E..a/........^...5;..;?..#..]>.........._..x....*3.. ....../......z..r..../"..y..........."-.....f...V...............-......./....Y...|............................................(............. ..................................++Y.((.v !.f...v...DLZ.............02..23..*-.q.'.c...V....7?..OS......5;W.:;../7..4-..L...@..h....09..SP..5W.>?.5A..C3...........O...9C..DH..+.:E..K:...........Y...38..0=..R9......GF.............b...&,..*1..>2.........t;..........j..b.#.r.'..8(.............2W.. .....?...F...V...............W............I...h..............................Z.m...Y...u.......Y..........................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\d467a4ce-79ae-470d-a2be-2fe20881d079.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203079
                                                                                                                                                                                                                                                      Entropy (8bit):6.879026494610918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5224D83245656524F3D6A74CDFB5855A
                                                                                                                                                                                                                                                      SHA1:3B4B6C9F8894978F776BF4A6367B19A923D10981
                                                                                                                                                                                                                                                      SHA-256:29A2BD6511A06E7EA6E797BEB2D93415D80D07F2D6D1773C12FD1E8553D7AE5E
                                                                                                                                                                                                                                                      SHA-512:DFBAC70C0BF0A9058686B193DC5D88CC585DBCCD9537C2DB56E7B63A298F221DE4EF66C018034E80DB5AEC7384FE847A788B77AF495CE6085A18C6C58160EB02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .)....M..(............. ..............................',..-,.v.#.b....$+..NY......33-.55.,3..%&.f...o....KM..`D-.;<..3@..R&..|...m...4&..BM..}7..7E..a/........^...5;..;?..#..]>.........._..x....*3.. ....../......z..r..../"..y..........."-.....f...V...............-......./....Y...|............................................(............. ..................................++Y.((.v !.f...v...DLZ.............02..23..*-.q.'.c...V....7?..OS......5;W.:;../7..4-..L...@..h....09..SP..5W.>?.5A..C3...........O...9C..DH..+.:E..K:...........Y...38..0=..R9......GF.............b...&,..*1..>2.........t;..........j..b.#.r.'..8(.............2W.. .....?...F...V...............W............I...h..............................Z.m...Y...u.......Y..........................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\databases\Databases.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):28672
                                                                                                                                                                                                                                                      Entropy (8bit):0.3407587842954347
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:315332044706528A5FE8A6DDE075F0B3
                                                                                                                                                                                                                                                      SHA1:00AFB7AD87D6B357F2AB8D7717A67951A2A9F0AA
                                                                                                                                                                                                                                                      SHA-256:05CF19B9848E82CA48587087B680AD6E5BF0C898E9505125E3B6EF46F7371D75
                                                                                                                                                                                                                                                      SHA-512:6E8553AB19864090437B9C006832A704CD3AFDE129AF4B272598CA0E1DA81E473AED4ADD82F857BFCE30042924FE6072958E766D7154C8D70CE0BA8AB6744FE6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\e897ed1e-6e4c-4312-9083-d3667c574e23.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 13 icons, 8x8, 32 bits/pixel, 10x10, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):203079
                                                                                                                                                                                                                                                      Entropy (8bit):6.879026494610918
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5224D83245656524F3D6A74CDFB5855A
                                                                                                                                                                                                                                                      SHA1:3B4B6C9F8894978F776BF4A6367B19A923D10981
                                                                                                                                                                                                                                                      SHA-256:29A2BD6511A06E7EA6E797BEB2D93415D80D07F2D6D1773C12FD1E8553D7AE5E
                                                                                                                                                                                                                                                      SHA-512:DFBAC70C0BF0A9058686B193DC5D88CC585DBCCD9537C2DB56E7B63A298F221DE4EF66C018034E80DB5AEC7384FE847A788B77AF495CE6085A18C6C58160EB02
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ .H............. ............... .p............. .h...n......... ............... ......... .... .....n...((.... .h.......00.... ..%..~H..@@.... .(B..&n..``.... .....N......... .(....D........ .)....M..(............. ..............................',..-,.v.#.b....$+..NY......33-.55.,3..%&.f...o....KM..`D-.;<..3@..R&..|...m...4&..BM..}7..7E..a/........^...5;..;?..#..]>.........._..x....*3.. ....../......z..r..../"..y..........."-.....f...V...............-......./....Y...|............................................(............. ..................................++Y.((.v !.f...v...DLZ.............02..23..*-.q.'.c...V....7?..OS......5;W.:;../7..4-..L...@..h....09..SP..5W.>?.5A..C3...........O...9C..DH..+.:E..K:...........Y...38..0=..R9......GF.............b...&,..*1..>2.........t;..........j..b.#.r.'..8(.............2W.. .....?...F...V...............W............I...h..............................Z.m...Y...u.......Y..........................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\fea872f7-22ed-4140-a957-fcce8d613285.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6506
                                                                                                                                                                                                                                                      Entropy (8bit):4.919756526619453
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:385311FB1B64419610031C33E0674FE9
                                                                                                                                                                                                                                                      SHA1:9179B2E099320131EAB9311B4595C3F0B622B892
                                                                                                                                                                                                                                                      SHA-256:224D87E066BD016E3A077CA28E8A74F5DC5154AC6C0BC800BB714A2F3144CA25
                                                                                                                                                                                                                                                      SHA-512:337B1215135D08967087D50F35D9647E8A4D27575CBAA120682C0A4838D7EECFE0673C9897D1BE7C88C16F68506B2F93C8CD4DFDE06142A8434C6FEE8620F6DD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"account_tracker_service_last_update":"13374268046000022","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13374268045880422","apps":{"shortcuts_arch":"","shortcuts_version":0},"autocomplete":{"retention_policy_last_version":122},"autofill":{"last_version_deduped":122},"browser":{"has_seen_welcome_page":false,"window_placement":{"bottom":1030,"left":10,"maximized":true,"right":955,"top":10,"work_area_bottom":1040,"work_area_left":0,"work_area_right":1920,"work_area_top":0}},"commerce_daily_metrics_last_update_time":"13374268045951337","countryid_at_install":18242,"default_apps_install_state":3,"dips_timer_last_update":"13374268047500041","domain_diversity":{"last_reporting_timestamp":"13374268045956250"},"enterprise_profile_guid":"541438e6-81c4-476f-899b-13aa51c35ca2","extensions":{"alerts":{"initialized":true},"chrome_url_overrides":{},"last_chrome_version":"122.0.6261.95"},"gcm":{"product_category_for_subtypes":"com.shift.windows"},"google"

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\heavy_ad_intervention_opt_out.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 2, database pages 4, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16384
                                                                                                                                                                                                                                                      Entropy (8bit):0.3519701014593642
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:80046BA5577179075EE928903CA1001C
                                                                                                                                                                                                                                                      SHA1:28647D0009423510827E8ACF7C5232B746F273CA
                                                                                                                                                                                                                                                      SHA-256:97B54B97D8CCD53EF9F6D44F6614C050AD320E239C6D72DC5DAAFBCCB9CC2494
                                                                                                                                                                                                                                                      SHA-512:B014BD2F2B1F3BE609942D285825F8B0C949E61871102D1BE4DE5A78E8A3199A20671D16EFAF59663A5866B7D78C436669B9B93A126A02BB1D3CF465097138E5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......Q......Q......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\power_bookmarks\PowerBookmarks.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 2, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                                                      Entropy (8bit):0.32904211154193835
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:98C67296D5DA53342179E5FB78A9F300
                                                                                                                                                                                                                                                      SHA1:C6B064C42EC19DCB7CF6D18A5F942A30DEB63FD2
                                                                                                                                                                                                                                                      SHA-256:31F64EAF0134042DA98E9E63AEB658DEEFC8BAD6FDB011F4407E7A77F2D6DB38
                                                                                                                                                                                                                                                      SHA-512:E1103573E500209FF2E2D9973E123E646B62E9BB08A2E779012A0D96F750B14ADAA1BD009CFBD07FB804A86C749F3297B7F361559E521DC0F98D58EC9528C265
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......T..g.......g.T................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7842
                                                                                                                                                                                                                                                      Entropy (8bit):6.64444902187063
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D6A11ABB60E2E480C78EC4EAE70B9105
                                                                                                                                                                                                                                                      SHA1:DE22D98FA8008B4409D037A125098A233269B906
                                                                                                                                                                                                                                                      SHA-256:EBFBB08F56693412B75703BA8DAA90B888FF8DC675A3A375276C9FCA8A89A940
                                                                                                                                                                                                                                                      SHA-512:C5978BC3DA862E2EBE7272AFA3E323B10B58A74B85AE63E5B12BF38986A94762E9C761C58069B60963EA2A055D3CCA257F614BBF8C71779A4CCEDEC946F316F6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...)................41_https://www.example.com/..F.................,U.................20_1_1...1...................37_DEFAULT_16v...h.... .(.0.R*.(....Session.TotalDuration.T<.A..GO .(.0.../.'.%....?..ChromeLowUserEngagement..Other...... .(...10...S..................37_DEFAULT_21........... .(.0.RZ.X...CCommerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage.w.cG$.. .(.0.8.R9.7...$Autofill_PolledCreditCardSuggestions...c..vP. .(.0...$........?..ShoppingUser..Other...... .(...10.\.3. ................37_DEFAULT_23........... .(.0.RH.F...1Omnibox.SuggestionUsed.ClientSummarizedResultType.q/.v.g:` .(.0.8.Ra._.DSELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00'......................dh...8.0........?..Low......@..Medium......A..High..None...... .(...10...T..................37_DEFAULT_27........... .(.0.R=.;...."%..wait_for_device_info_in_seconds..60*.SyncDeviceInfoh.p...t.r.p....AndroidPhone..IosPhoneChrome..AndroidTablet..IosTablet..Desktop..Other..Sy

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):265
                                                                                                                                                                                                                                                      Entropy (8bit):5.236566396398595
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BEF0610973896CD2EE74A92123A7F58B
                                                                                                                                                                                                                                                      SHA1:CE0FC90249E7A540F33A9FF720CCC99DFEDFA2C4
                                                                                                                                                                                                                                                      SHA-256:E69906C3743D436BA9F3999F66B216399527E04223F7B034CA2B230EBB7B7938
                                                                                                                                                                                                                                                      SHA-512:9740482F855D4A68A5AAEF40271CD02B796EB2C75F3E205AE1369255C52D70EC89D54348A26CEAD2BDE2CEF3EE3E2EF6BE579A3BF4CC4CE69A542F88C13DB541
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.490 17fc Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db since it was missing..2024/10/24-14:27:26.534 17fc Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata\000001.dbtmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):990
                                                                                                                                                                                                                                                      Entropy (8bit):4.0099388438092
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BCC931BCEA9E7AF2FBC070CB02C76BBB
                                                                                                                                                                                                                                                      SHA1:A66BDE500C105DA8330CDF8A4AD3A027DB106445
                                                                                                                                                                                                                                                      SHA-256:AAF32FC1CE6351D745E2E66877589A5DFCF75B38A3F7FE83F2BBB0C255A4BD5C
                                                                                                                                                                                                                                                      SHA-512:DDACB6047B580B91C1428448A7FAEFC21B00E869A2F82A616B1A897C0D07FC3CF20E39DFADCECAD218ACB78D863F090F2B197C4CEB54573A21FD4615EDDCFCFF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.h.6.................__global... .t...................__global... ...w.................44_.....a....................48_.....|G...................49_......G&..................33_.......fA.................41_.......S.................32_.......5..................21_......4...................44_........5.................48_.....*.s..................33_.....tY...................49_......%...................41_.......[..................32_.......6..................21_......&.;.................20_..........................19_.....~.D[.................37_......Q...................38_..........................39_.....}....................9_......u-..................18_........D.................3_.......M..................4_.......j.................20_......n}[.................19_.....m.;..................37_..........................38_.....,...................39_..........................9_........q... .............18_........L...!.............3_........i...".............4_.....

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata\CURRENT (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16
                                                                                                                                                                                                                                                      Entropy (8bit):3.2743974703476995
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                                                                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                                                                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                                                                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):283
                                                                                                                                                                                                                                                      Entropy (8bit):5.1692432574454275
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:044857E1FB2357C731916B618433CE9F
                                                                                                                                                                                                                                                      SHA1:13BE19AB1E44B9F4DED8D77422C184B3321EFCC0
                                                                                                                                                                                                                                                      SHA-256:66C62607A4170F1748F90AB727FEFFE31F0042A30BF9072B591F2C1EA1926A1D
                                                                                                                                                                                                                                                      SHA-512:506269D4BC659785B64228A45B185D1D4AF2E6197A14C0089D31B7BF58F22E0C0CC2F7F96E87F02344C13BD4756CF7FC98B52722F10B1F254373F44BC60A1D0B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:2024/10/24-14:27:26.106 17fc Creating DB C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata since it was missing..2024/10/24-14:27:26.145 17fc Reusing MANIFEST C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:OpenPGP Secret Key
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):41
                                                                                                                                                                                                                                                      Entropy (8bit):4.704993772857998
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                                                                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                                                                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                                                                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45056
                                                                                                                                                                                                                                                      Entropy (8bit):0.2104874894092857
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F39B18FBEE80EAEFB4F9AAE69CD3127B
                                                                                                                                                                                                                                                      SHA1:800CBF10C069A90968F8A9B5C2E62FA5D482BF13
                                                                                                                                                                                                                                                      SHA-256:355AF55D3785B5EF9F630B31BAB118AADFAA4FAD8E1F401836AF7DD9F422A40A
                                                                                                                                                                                                                                                      SHA-512:6207088C213F0973E9FD16C0AC2E1FDB68CC506D0DE4455BC66084555A905F1DD0362D21AB09253542138BA7D62E83D27274E90FE7A7E0697630021D8824724A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):0.36351356346355584
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:637AED0F0B053729B5BDEF9F8969DEE9
                                                                                                                                                                                                                                                      SHA1:1B78686B05644E03AAE2F514DE5DF451C5B115BC
                                                                                                                                                                                                                                                      SHA-256:98B2385C782E18CB66524CB7987637038D58E3C2D21DBAD14A879CF79628388F
                                                                                                                                                                                                                                                      SHA-512:582474A6E3C8C94A3AF1390F9F101960BA826555F2D674C96A45260D1431B40EB48265C67C56CCF47B5B17224426D6E51B614BF6DB6A0DD41F08B10E28EFFFA8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4202496
                                                                                                                                                                                                                                                      Entropy (8bit):0.4373400699308951
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:292084298FB245E2B8842230F7B6E2CE
                                                                                                                                                                                                                                                      SHA1:1018F7328604881B1D28D74938A19AE1A21051BE
                                                                                                                                                                                                                                                      SHA-256:BBA1D6967C9E3C93DFEB550724B588A859BEF3DA9B77FC44F54A17002A91F8EA
                                                                                                                                                                                                                                                      SHA-512:1C88D21B27D412BB3ABC15C4A41173BEAD1AA0609FEC00761CF968BB3A14AFEF6A3A6E79444EE42984D48E7F88366680554EA3CC10BA86C480526C85072F6FE0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.................................................................................w........w.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\f_000001

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):16688
                                                                                                                                                                                                                                                      Entropy (8bit):4.725298818464538
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:651450DDB68DDB8FEEC3653EE2EE3B21
                                                                                                                                                                                                                                                      SHA1:BD91EC558F16F10EABC8497DEDA0C42C366C3C6C
                                                                                                                                                                                                                                                      SHA-256:489F0896541A1F47A11EC077105079E294CCA42F78417E33080E445E2928C816
                                                                                                                                                                                                                                                      SHA-512:85D04E8612191E530FF47CEC45686CF5778987F94FA9455F1A9AF83BE0B50B54D9A88ADD1E6433116B8F7127AEBBA5CD1361048042FC0EFF0101B91EF86A6430
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....BPLG.........A..b1b39c3d02c11492....Z...d.......ANGLE (Intel, Intel(R) UHD Graphics 630 (0x00003E98) Direct3D11 vs_5_0 ps_5_0, D3D11-27.20.100.9415)........................................................................................................................................................................................,...............,.......................radii_selector........_uradii_selectorR.......................corner_and_radius_outsets........_ucorner_and_radius_outsetsR.......................aa_bloat_and_coverage........_uaa_bloat_and_coverageR.......................radii_x........_uradii_xR.......................radii_y........_uradii_yR.......................skew........_uskewR.......................translate_and_localrotate........_utranslate_and_localrotateP.......................color........_ucolorR.......................R..................................................................sk_RTAdjust........_usk_RTAdjust....................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\f_000002

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20004
                                                                                                                                                                                                                                                      Entropy (8bit):4.783878512409617
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FA87CCFC58B130A3920FECED46A4217A
                                                                                                                                                                                                                                                      SHA1:E4FF00AE3CDEF98E22AAAF4EC5D9BD69663ADC39
                                                                                                                                                                                                                                                      SHA-256:DA4AB4FAF0E98826C7420FBD38F61B2634F2BB45EB31A3A92F0E89A811C56936
                                                                                                                                                                                                                                                      SHA-512:37DD0AEB1ED240555CEB6E1219755CFA3D92BAFF1C7A3A023D2A4B9CEEDF146F3DE4FEADAC6410B903D878E9319FD470AC63D8CE8BDE27CD6140BDD028317E35
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....BPLG.........N..b1b39c3d02c11492....Z...d.......ANGLE (Intel, Intel(R) UHD Graphics 630 (0x00003E98) Direct3D11 vs_5_0 ps_5_0, D3D11-27.20.100.9415)........................................................................................................................................................................................,...............,.......................radii_selector........_uradii_selectorR.......................corner_and_radius_outsets........_ucorner_and_radius_outsetsR.......................aa_bloat_and_coverage........_uaa_bloat_and_coverageR.......................radii_x........_uradii_xR.......................radii_y........_uradii_yR.......................skew........_uskewR.......................translate_and_localrotate........_utranslate_and_localrotateP.......................color........_ucolorR.......................R..........................................................P..........................................................R..............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\f_000003

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20156
                                                                                                                                                                                                                                                      Entropy (8bit):4.787464692015212
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7925BE350D092283AF2CCCF5DBC4C53F
                                                                                                                                                                                                                                                      SHA1:C05FE63F6870353B4FD19CC159F62122B07F1D6F
                                                                                                                                                                                                                                                      SHA-256:146A1B0C8465D02DA52AC67C2B169A095B98DFAF50394B3C90E7EB6ADA5324C3
                                                                                                                                                                                                                                                      SHA-512:3D66F71B2709F4AF7AD6DD1DE79336D8382F34A930F80935BF31F6B11D114C8C80F5DD755210B2CCD01AF044B234E19119C6357D49623BF82AD22A975CF1151C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....BPLG.........N..b1b39c3d02c11492....Z...d.......ANGLE (Intel, Intel(R) UHD Graphics 630 (0x00003E98) Direct3D11 vs_5_0 ps_5_0, D3D11-27.20.100.9415)........................................................................................................................................................................................,...............,.......................radii_selector........_uradii_selectorR.......................corner_and_radius_outsets........_ucorner_and_radius_outsetsR.......................aa_bloat_and_coverage........_uaa_bloat_and_coverageR.......................radii_x........_uradii_xR.......................radii_y........_uradii_yR.......................skew........_uskewR.......................translate_and_localrotate........_utranslate_and_localrotateP.......................color........_ucolorR.......................R..........................................................P..........................................................R..............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\f_000004

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):20152
                                                                                                                                                                                                                                                      Entropy (8bit):4.786934896415001
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:83C308079EFDC6F8EE3A38E3D0AE7667
                                                                                                                                                                                                                                                      SHA1:D7A6EB93E48EA9CC8887FDB22347499431EFB030
                                                                                                                                                                                                                                                      SHA-256:E68C12CA30D38FD31920B8DA996AF0140A51792B463F8F42573EB0CB92D97A39
                                                                                                                                                                                                                                                      SHA-512:E1AB5A7978B57152A081D15C5043EB5D273B37C1BAFE861C155396311B508E2674C852BA9280DDF3948737B9F49CC928BE58BD2E6E6BC23B3D87166A1D82B397
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....BPLG.........N..b1b39c3d02c11492....Z...d.......ANGLE (Intel, Intel(R) UHD Graphics 630 (0x00003E98) Direct3D11 vs_5_0 ps_5_0, D3D11-27.20.100.9415)........................................................................................................................................................................................,...............,.......................radii_selector........_uradii_selectorR.......................corner_and_radius_outsets........_ucorner_and_radius_outsetsR.......................aa_bloat_and_coverage........_uaa_bloat_and_coverageR.......................radii_x........_uradii_xR.......................radii_y........_uradii_yR.......................skew........_uskewR.......................translate_and_localrotate........_utranslate_and_localrotateP.......................color........_ucolorR.......................R..........................................................P..........................................................R..............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\f_000005

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):19996
                                                                                                                                                                                                                                                      Entropy (8bit):4.781907555239464
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E874B8320905FE7B077AFB8B04EF9BCB
                                                                                                                                                                                                                                                      SHA1:E3B0485D889BF35A85B67FCFDB64C60942A1E51D
                                                                                                                                                                                                                                                      SHA-256:C511EF5CA7F446AAF5824FCF7EBE1F63844EA0C9D4F8FE879DFCFD00187C81C8
                                                                                                                                                                                                                                                      SHA-512:3F05E49034F6C19D1D48B8FB2A6BAC2E8954EA54AFE681A3F88A27D944F98D0579F24C8E7F1457BA742BFE80DE72A4040CA9E70ABB050F09114220CA6CC03550
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....BPLG.........N..b1b39c3d02c11492....Z...d.......ANGLE (Intel, Intel(R) UHD Graphics 630 (0x00003E98) Direct3D11 vs_5_0 ps_5_0, D3D11-27.20.100.9415)........................................................................................................................................................................................,...............,.......................radii_selector........_uradii_selectorR.......................corner_and_radius_outsets........_ucorner_and_radius_outsetsR.......................aa_bloat_and_coverage........_uaa_bloat_and_coverageR.......................radii_x........_uradii_xR.......................radii_y........_uradii_yR.......................skew........_uskewR.......................translate_and_localrotate........_utranslate_and_localrotateP.......................color........_ucolorR.......................R..........................................................P..........................................................R..............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GrShaderCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D8660999A858ED6EBD344BE5F0215B8F
                                                                                                                                                                                                                                                      SHA1:0D9122179B488E0C57A7D01BF91869138B9FAE73
                                                                                                                                                                                                                                                      SHA-256:667542F7937A5B8D7CA9C9F3F260BE0E22CAD239ECFE27A7F4EDF5569DC027E2
                                                                                                                                                                                                                                                      SHA-512:51B517CFD90F5C3A1FD73D1D755E6903DC362E49164949BB0616099933196B1F31B7B6DC5C4FCB0EB7028BAB6BA405B1774D40D358105C13DC71E9EA3E15B645
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...........................................p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GraphiteDawnCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GraphiteDawnCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GraphiteDawnCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GraphiteDawnCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\GraphiteDawnCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E43CD63373D0DB16D1C17B12AAF97831
                                                                                                                                                                                                                                                      SHA1:5102AEBDAD4D2AF999AEF0D89FDE02C51633018A
                                                                                                                                                                                                                                                      SHA-256:3224879B3AD6EC6D62A401F703EF6BEB55B626A897953C942B74DDA7DD912005
                                                                                                                                                                                                                                                      SHA-512:190701E07152784C63DFE221A6B9BA84D8BC14DF43AF5A3537426EB6FB10D5624FC6582B0217D0DE1DAD90D583B7575198CBF4F58D13652BBF0D940ED1212DAB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........................................2.p./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Last Browser

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):108
                                                                                                                                                                                                                                                      Entropy (8bit):3.167526765312688
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:32EB793F4D09890293A66C06C4ABDEB8
                                                                                                                                                                                                                                                      SHA1:BB7CE021D4B1011453A7E2126AE7B35CAB8AE28D
                                                                                                                                                                                                                                                      SHA-256:23CFD22F9A549B7217EFE805D15425335893C95D5A122EAE3B0EF9B89EC432C9
                                                                                                                                                                                                                                                      SHA-512:633AEE98B0E0E8E6718C6F70F1BAF930F2E0886F0FF87B4F77C4B36CAE4B85A171F182D45FD20E93910B11EAE04DC66E9E4B557FA83034FC9EC6F677DE65A8EA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Last Version

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):13
                                                                                                                                                                                                                                                      Entropy (8bit):2.6612262562697895
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:91A777B794123B4A6663536BEC0555F8
                                                                                                                                                                                                                                                      SHA1:348B9F302C8282D4CEBFD35E8D24A64DB1687741
                                                                                                                                                                                                                                                      SHA-256:6D73F9A473D7847E3BE075639A3AD5166A3FF2425B29D4749609305C1869D38E
                                                                                                                                                                                                                                                      SHA-512:9B2FC9F68B17EBCCDCB97FF1717523E7C8957408D2A2429C73CA6F6F3890BD013F20E90283DEC8AC428A4CF2CE55A75EE44CDF9CB38B2518C84EA443BE00F609
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:122.0.6261.95

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Local State (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):976
                                                                                                                                                                                                                                                      Entropy (8bit):5.659853420035044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E369648C22B1A0BA78B31EDE5D1872E
                                                                                                                                                                                                                                                      SHA1:CC7126E326D4DC3BED31F7C41E1D8F4D86E566EB
                                                                                                                                                                                                                                                      SHA-256:61C4E0878AFC8608E19E853C5DB62CB250D805A0E73E6BAB0B12DAB5C32CF2E6
                                                                                                                                                                                                                                                      SHA-512:967E7692689FA7A74188711E369E51792036FCC036B8620AA77638ACD0BCCE20AEA459A53071A272E5137444A86D52B602F1CC447E3C037243F1CCDBAF4A5231
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{},"profile_counts_reported":"13374268045565482","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1729794445"},"user_experience_metrics":{"low_entropy_source3":4647,"pseudo_low_entropy_source":2561,"stability":{"browser_last_live_timestamp":"13374268045483057","stats_buildtime":"1708978522","stats_version":"122.0.6261.95-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"16"}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Local State~RF60631c.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):976
                                                                                                                                                                                                                                                      Entropy (8bit):5.659853420035044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E369648C22B1A0BA78B31EDE5D1872E
                                                                                                                                                                                                                                                      SHA1:CC7126E326D4DC3BED31F7C41E1D8F4D86E566EB
                                                                                                                                                                                                                                                      SHA-256:61C4E0878AFC8608E19E853C5DB62CB250D805A0E73E6BAB0B12DAB5C32CF2E6
                                                                                                                                                                                                                                                      SHA-512:967E7692689FA7A74188711E369E51792036FCC036B8620AA77638ACD0BCCE20AEA459A53071A272E5137444A86D52B602F1CC447E3C037243F1CCDBAF4A5231
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{},"profile_counts_reported":"13374268045565482","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1729794445"},"user_experience_metrics":{"low_entropy_source3":4647,"pseudo_low_entropy_source":2561,"stability":{"browser_last_live_timestamp":"13374268045483057","stats_buildtime":"1708978522","stats_version":"122.0.6261.95-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"16"}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Local State~RF60b3ad.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):976
                                                                                                                                                                                                                                                      Entropy (8bit):5.659853420035044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E369648C22B1A0BA78B31EDE5D1872E
                                                                                                                                                                                                                                                      SHA1:CC7126E326D4DC3BED31F7C41E1D8F4D86E566EB
                                                                                                                                                                                                                                                      SHA-256:61C4E0878AFC8608E19E853C5DB62CB250D805A0E73E6BAB0B12DAB5C32CF2E6
                                                                                                                                                                                                                                                      SHA-512:967E7692689FA7A74188711E369E51792036FCC036B8620AA77638ACD0BCCE20AEA459A53071A272E5137444A86D52B602F1CC447E3C037243F1CCDBAF4A5231
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{},"profile_counts_reported":"13374268045565482","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1729794445"},"user_experience_metrics":{"low_entropy_source3":4647,"pseudo_low_entropy_source":2561,"stability":{"browser_last_live_timestamp":"13374268045483057","stats_buildtime":"1708978522","stats_version":"122.0.6261.95-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"16"}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Local State~RF61521f.TMP (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):976
                                                                                                                                                                                                                                                      Entropy (8bit):5.659853420035044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E369648C22B1A0BA78B31EDE5D1872E
                                                                                                                                                                                                                                                      SHA1:CC7126E326D4DC3BED31F7C41E1D8F4D86E566EB
                                                                                                                                                                                                                                                      SHA-256:61C4E0878AFC8608E19E853C5DB62CB250D805A0E73E6BAB0B12DAB5C32CF2E6
                                                                                                                                                                                                                                                      SHA-512:967E7692689FA7A74188711E369E51792036FCC036B8620AA77638ACD0BCCE20AEA459A53071A272E5137444A86D52B602F1CC447E3C037243F1CCDBAF4A5231
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{},"profile_counts_reported":"13374268045565482","profiles_order":[]},"uninstall_metrics":{"installation_date2":"1729794445"},"user_experience_metrics":{"low_entropy_source3":4647,"pseudo_low_entropy_source":2561,"stability":{"browser_last_live_timestamp":"13374268045483057","stats_buildtime":"1708978522","stats_version":"122.0.6261.95-64-devel","system_crash_count":0}},"variations_limited_entropy_synthetic_trial_seed":"16"}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\ShaderCache\data_0

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.01057775872642915
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CF89D16BB9107C631DAABF0C0EE58EFB
                                                                                                                                                                                                                                                      SHA1:3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
                                                                                                                                                                                                                                                      SHA-256:D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
                                                                                                                                                                                                                                                      SHA-512:8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\ShaderCache\data_1

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):270336
                                                                                                                                                                                                                                                      Entropy (8bit):8.280239615765425E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D0D388F3865D0523E451D6BA0BE34CC4
                                                                                                                                                                                                                                                      SHA1:8571C6A52AACC2747C048E3419E5657B74612995
                                                                                                                                                                                                                                                      SHA-256:902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
                                                                                                                                                                                                                                                      SHA-512:376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\ShaderCache\data_2

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.011852361981932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0962291D6D367570BEE5454721C17E11
                                                                                                                                                                                                                                                      SHA1:59D10A893EF321A706A9255176761366115BEDCB
                                                                                                                                                                                                                                                      SHA-256:EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
                                                                                                                                                                                                                                                      SHA-512:F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\ShaderCache\data_3

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8192
                                                                                                                                                                                                                                                      Entropy (8bit):0.012340643231932763
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:41876349CB12D6DB992F1309F22DF3F0
                                                                                                                                                                                                                                                      SHA1:5CF26B3420FC0302CD0A71E8D029739B8765BE27
                                                                                                                                                                                                                                                      SHA-256:E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
                                                                                                                                                                                                                                                      SHA-512:E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\ShaderCache\index

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):262512
                                                                                                                                                                                                                                                      Entropy (8bit):9.553120663130604E-4
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BA06896E44868682E51CBCBFC852A113
                                                                                                                                                                                                                                                      SHA1:86442C16962EF521FA5E8EE7BC7EC3D77D20C732
                                                                                                                                                                                                                                                      SHA-256:CF7D2FFA0CB6AE7F8E34362C7CC7B59D5E6F5BB0E194C0A98CF6AD66612AA4AB
                                                                                                                                                                                                                                                      SHA-512:569F5C6982B38F25D87A3CF7ABAEBFEA71A5910CB12269FEE63D171A6EA1A038E39AB2E16CAC7D320C8C55DD7F22D7DEF0BE43BBF57BDF9BDB8AF5C1F8483A7B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........................................(.o./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\Variations

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):86
                                                                                                                                                                                                                                                      Entropy (8bit):4.3751917412896075
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:961E3604F228B0D10541EBF921500C86
                                                                                                                                                                                                                                                      SHA1:6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
                                                                                                                                                                                                                                                      SHA-256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
                                                                                                                                                                                                                                                      SHA-512:535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\cedff6fa-1e63-4bdc-997a-7e336bd9bcee.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2564
                                                                                                                                                                                                                                                      Entropy (8bit):5.338994500770308
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A66959D10494159E0C8FDFCFA2218D85
                                                                                                                                                                                                                                                      SHA1:4DAA4454332B0D35BDA50E6B644E9EB7435E2F81
                                                                                                                                                                                                                                                      SHA-256:489C9E5D3561FA40B1686F03930EE1F23AE86AF97D40526660A5E24678FBA69D
                                                                                                                                                                                                                                                      SHA-512:DBE1880FF22460C36B2122F62A96A1295EED6BEADE3521A15C41B92D0A95F6796B8F57865C113D49374936CFC37E8E86AB02F4A9CAD7E1E88DFDE2D553B92976
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"breadcrumbs":{"enabled":false,"enabled_time":"13374268045737222"},"browser":{"first_run_finished":true,"shortcut_migration_version":"122.0.6261.95"},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"management":{"platform":{"azure_active_directory":0,"enterprise_mdm_win":0}},"optimization_guide":{"model_store_metadata":{}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAA6vxecm76BQJWKOsxqFV2AEAAAAAwAAABTAGgAaQBmAHQAAAAQZgAAAAEAACAAAAApQSjNF+QmS0KWBlV60MD/0djfKR5laIbl9EtRkDCRZgAAAAAOgAAAAAIAACAAAAA4FFpHgazV1oqQyYGG/f/I3Z+UgzgZoHU+06CplJC1EzAAAACvbiiX3fxi+dWwfZp+jYR+SZHgEYQx1DU6+DSanCy5IVJm9JmdGrkxRM9WJuHHactAAAAAtJ4egSJk3jB7xMUaekUDjyhBabbyBiqMpdcdLoRQuSEMaGqGaUFI5sS+SmBf8qA2p2vQgmX6fnVaSs9Oxn1Dsw=="},"policy":{"last_statistics_update":"13374268045736406"},"privacy_budget":{"generation":10,"selected":"1"},"profile":{"info_cache":{"Default":{"active_time":1729794447.483303,"avatar_icon":"chrome://theme/ID

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\first_party_sets.db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 1, database pages 12, cookie 0xa, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):49152
                                                                                                                                                                                                                                                      Entropy (8bit):0.5159194832610118
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6770DA387652C2B07DB07C9F06C4EBA5
                                                                                                                                                                                                                                                      SHA1:F50AAC2964A48E9E684B4DA3CD8F64114AB98C5D
                                                                                                                                                                                                                                                      SHA-256:F6B467B70D7559D5B7862A2683E75AE9D173DFF806F0EAECCCBBEC6A107D4E2F
                                                                                                                                                                                                                                                      SHA-512:5D3713E7E31E709417FD34E88F795B060BF79F8FD05AF22111BF073E9FD6C492FD6E0903F88CF3915B9D88308BD94951791121DB8D700D37029BAA1F1328CA55
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r.......\..g.................C.\......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\User Data\segmentation_platform\ukm_db

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3044002, file counter 6, database pages 7, cookie 0x6, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):28672
                                                                                                                                                                                                                                                      Entropy (8bit):0.3626505885011103
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3979944F99B92E44FA4B7DBCB6EE91C2
                                                                                                                                                                                                                                                      SHA1:DF2161C70A820FE43801320F1C25182F891261A4
                                                                                                                                                                                                                                                      SHA-256:001D755B2B560945440023BF4EBFBDA797CF5106419AC7DD270924B322F3ECF3
                                                                                                                                                                                                                                                      SHA-512:358E6DEE698A63C2490C2FB5206516766FD8ACE8F3D523509C29FF76AA6A984CB6381468F15BB4B9C084D9A470298B4CC11B0970E671CE0316243069AC4C8590
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................r..................x..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\.configurations\install-info.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):166
                                                                                                                                                                                                                                                      Entropy (8bit):5.106071300190369
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A063B9DFA5D67E04EF69D0BE4E77752D
                                                                                                                                                                                                                                                      SHA1:C1A2D97773204AB1B5267D4FED0EA42813E04277
                                                                                                                                                                                                                                                      SHA-256:B0FF709EB068446AC043771497217D6B56970002CE36E09BA12DA3CF910AD540
                                                                                                                                                                                                                                                      SHA-512:58993D5A421535FAE18F60752F7E18001657A9F399E06873F461BA7B0564D67B7C208F355259B875D96A6D60FA13800D0310E231FBF13CD2CB1975D1EB03516C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"install_time":1729794414,"distinct_id":"7A34B566-4984-4E51-85EE-ABA859F40C17","default_browser":"ChromeHTML","initial_version":"122.10.0.1101","attribution_key":""}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\.configurations\server-settings.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1228
                                                                                                                                                                                                                                                      Entropy (8bit):5.060475022548804
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0CA6E26E35D635C54FDAB6F4022367F7
                                                                                                                                                                                                                                                      SHA1:B3DE6C2E779266426831DC56E6F98F5BC19B8E81
                                                                                                                                                                                                                                                      SHA-256:53002C51FCBBD3D04C8A018A9DAEE48108E11072D14B77DEA38551E11D2906BE
                                                                                                                                                                                                                                                      SHA-512:BA53DC2AA8C3F7CE6C45BDE58EA309C903314631002B86047C5AB9F3B22D2593CE862A861C1190AF5F4F2D2EE001C3ED3ABFAF731B70CC167BF11A2127EBCD2E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"accuweather_api":"7f64ed3093d8436e994f9dc7e382a06a","amazon_url":"https://wbd_ol.ampxdirect.com/amazon?sub1=default&sub2=amazon","new_tab_url":"https://shiftntp.com/g/","policy_loader_extensions":[],"preload_extensions":[],"rich_suggest_url":"https://us.search.yahoo.com/sugg/gossip/gossip-us-fastbreak?command={searchTerms}&output=fxjson&appid=shift-rich","search":{"default":2,"overrides":{"new_tab_url":"https://shiftntp.com/g/"},"search_engines":{"engine_1":{"encoding":"UTF-8","favicon_url":"https://search.yahoo.com/favicon.ico","id":2,"keyword":"yahoo.com","monetized":true,"name":"Yahoo!","new_tab_url":"https://shiftntp.com/g/","search_url":"https://search.yahoo.com/yhs/search?hspart=shift&hsimp=yhs-shift&p={searchTerms}&type=0_2000_100_1000_100_241024","suggest_url":"https://us.search.yahoo.com/sugg/gossip/gossip-us-fastbreak?command={searchTerms}&output=fxjson&appid=shift-rich"}}},"search_name":"Yahoo!","search_url":"https://search.yahoo.com/yhs/search?hspart=shift&hsimp=yhs-shift

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\.configurations\split-tests.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):360
                                                                                                                                                                                                                                                      Entropy (8bit):4.51645143464576
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8B853B25E4B9155C22C3417B353CDB8A
                                                                                                                                                                                                                                                      SHA1:AEA98E97BD6DB8FE9FFD5A2903ABE533EE5E59DD
                                                                                                                                                                                                                                                      SHA-256:8FF714B601799F8E4A22DA089C6142DC6CF92B32135E6C4BA2B9DE224E02AD1E
                                                                                                                                                                                                                                                      SHA-512:4FB4F78D8FFB4A6B980368015AA39E40BF9D3FB57CE4598FFB19C54002C44F821C0470A2E067FBBECACD5D7F7C72E1238C2EE03B8C2F53D0FB1B00970217AB65
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"attribution_split_tests":{},"encoded_splits":"000","local_split_tests":{"split_brx570_close_app_dialog":{"value":"variation"}},"no_split":false,"server_side_split_tests":{"split_st1232_rename_shortcuts_shift_browser":{"replacements":[],"value":"variation"},"split_st1391_dont_import_history":{"replacements":[],"value":"variation"}},"split":"c","split2":"a"}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\122.10.0.1101.manifest (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):225
                                                                                                                                                                                                                                                      Entropy (8bit):4.8117977927405695
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:941DCF61AC29C9DA9F37D833FC6D27B5
                                                                                                                                                                                                                                                      SHA1:6F99668DB8EF0B37C97A6BA3095F965454785AD5
                                                                                                                                                                                                                                                      SHA-256:7EB68EA50A5373F9A5E6E72B2FD000565E6B21B1E545161BE91CDC233F18B98B
                                                                                                                                                                                                                                                      SHA-512:1E03DC56CC639555F38F7E262A1A24F7045B7E0937249ADAA42C72AE4E7C89076E85DF85ADB8BB79E08AED527841A4D848A8D087756B1600F153143CC5203701
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='122.10.0.1101'.. version='122.10.0.1101'.. type='win32'/>.. <file name='shift_elf.dll'/>..</assembly>..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\af.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):432343
                                                                                                                                                                                                                                                      Entropy (8bit):5.405941245339364
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2978C77C9FC9D3313A63445F7A994DBA
                                                                                                                                                                                                                                                      SHA1:32DCA3E90B72B10415056C5B52A160643A6DB4DB
                                                                                                                                                                                                                                                      SHA-256:760FBF527F137ACEE407B0F30520081A2C11E8749B74D8F3C47499287EE06C4A
                                                                                                                                                                                                                                                      SHA-512:98B296A62A6E429A694FE4AF161A977A0F239A288B586ABB95DE3BB7875F34AFA71EB245D2C8C2408543C57F836F029329053CD3CC1B4228BC442EC35CA8471C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|.........................................................................................x...........4.....E.................7.....H...........#.....g.....|...........B.....w................./.....X.....f.................9.....I.................4.....S.................N.....k...........%.....Y.....k.................U.....d...........5.....s.................q.................%.....f.......................(.....K.....X.............................h.......................^.......................D.............................U.....|.......................G.....P...........8.......................5.....Y.....q.................9.....T.......................'.................=.....o.................&.....9.......................$.......................8...........9.......................|.................M.......................4.....x.......................X.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\af.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\am.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):678351
                                                                                                                                                                                                                                                      Entropy (8bit):5.076897942157497
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:EB50FC3F8C25754A1A19C16B77CD9D71
                                                                                                                                                                                                                                                      SHA1:92045342072EC1E0E252D15FA76E3BE0D84DF464
                                                                                                                                                                                                                                                      SHA-256:95AFAF5BEF7B1AFCD7427E01E6C13E5F6F1674D219E3A587943FA8C64C9103F8
                                                                                                                                                                                                                                                      SHA-512:118575B4FB2E735E660C11FDA9AD855F56D5480E06C06C78D112D5690ED1776FE6990B87FF8BD7B934F8461A03A4829BC39B08928293B118F1E0DC81C065DAB8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}.....................................................................................!.....@.............................f.............................Z.......................t.............................M.....`...........Y.................W...........(.....X.....;...........M.........................................M.................r...........c...........].......................K.......................k.................&.................3.....F.......................0...........`.................c...........B.....X...........p.................]...........'.....7.......................9...........,.....f...................................z...........4.....M.......................6.................Q.....s...................................2.......................Q.......................j.........................................q.............................a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\am.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ar.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):743531
                                                                                                                                                                                                                                                      Entropy (8bit):5.0623318835033055
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:83CECA202112AB6C1524DB354AD6A25F
                                                                                                                                                                                                                                                      SHA1:923357FB6B0E9BA9746A0A17C18D7C91D3906E17
                                                                                                                                                                                                                                                      SHA-256:66681B0DB2A0CFCF8499613B613F49CB8A54373B1E895EFDE1FECB3C6C9F96B1
                                                                                                                                                                                                                                                      SHA-512:F23B8F1F404E56FFB48B8B66060DC46CB59B62BF58C21889F641595F1ADD808BF9D4C3B8FD89C46919F9EF4C29AF6B616EFFDC300B0A1A5149E7F09E96A5BCD5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.d...h.i...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}./.....7.....<.....D.....L.....T.....[.....b.....i.....k.....p.....................................................S...........J.....l.................;.....W.......................K...........f.................9............................./.......................*.......................j.......................O.................q.....:.............................[...........>.................'.................C.....X...........b.................r.....(.................6.............................E.................?.............................%.....j.............................3...........2.....j.............................j...........a...........#................./.................*.....G...........j.................`.................2.....:.............................;.................R.................*.......................-...............................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ar.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\bg.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):771584
                                                                                                                                                                                                                                                      Entropy (8bit):4.835506405369879
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:983FA172C059DFD7708957582CB4B880
                                                                                                                                                                                                                                                      SHA1:E68C5A19FC3A6AFD6173285CC2734DB7EFD185BF
                                                                                                                                                                                                                                                      SHA-256:F916D26768743DE45B7090D9024FEB557335AC77501F0DB319DFDE75AC7F8C2C
                                                                                                                                                                                                                                                      SHA-512:36C26A89A627E4507D27A406DFABB7227BBEC5CD4A94A177A2E828CA4E5F9C175F1F5ADAB6061E27FEC4C63A9833BAB8E1A67A8E4F5DF23B18F326AFC978C169
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................@.....M.....'.......................x................./...................................6...........!.............................6.......................K.............................S.................J.......................y.............................<.....v...........b...........E...........r.............................b...........).............................l.............................i...............................................P.....v.......................!.........................................T.....................................................8.....1...........]...........y...........>.....n.....8...........3.....e.....S...........h.................h...........4.....,...........d...........y...........l...........H............ ....D ....?!....."....."

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\bg.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\bn.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):974435
                                                                                                                                                                                                                                                      Entropy (8bit):4.454267523838959
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F8CFC4DBB18026B4D8D7C8E54996CE49
                                                                                                                                                                                                                                                      SHA1:B8456FBF874A86F265A938BC062E851FFCCD8698
                                                                                                                                                                                                                                                      SHA-256:34BDEF7BE00711A45E3ACAA986A620B3E2C7FEB5149ED2E86BC4482F3E56294A
                                                                                                                                                                                                                                                      SHA-512:05843850E487005DD705774BFC39E4F130D41A315BFB30F227AB82427A315A7F23C8E39589E1099F52D57DABE3E06A2B25FAB5FEE731EFA9E4F206F53911562E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....z.................................................................P.....z...........@.....|.....q.....H...........!.....F.....@...........=.....5.......................{.....>.......................>.............................H.................k...........Q.....@.............................B.............................T.......................H...........e...........C.....v...................................?.....r...........u.....$.........................................j...........^...........,.................;.............................&.....B...........U.....O.......................x...........C.....s.....A...........n.................[...........j.....$.................6.................$.....\....._....................... ....t!....g".....".....#.....$....x%.....%.....&....|'.....'....'(.....(.....).....*....]*....c+....7,

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\bn.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ca.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):490657
                                                                                                                                                                                                                                                      Entropy (8bit):5.381493625399228
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C8D71F3E86934D84781196D2DC57BC4D
                                                                                                                                                                                                                                                      SHA1:6F13F909A551D3553800C9F164AC53D4E8E19191
                                                                                                                                                                                                                                                      SHA-256:F946C994D185F25F22AB113EFD6C6D9C4CF42FCB1DA056658F40840C28AC76AE
                                                                                                                                                                                                                                                      SHA-512:421CDACD2FDDAD59D5405BBB76AB09195600B1DD69E49C0923CD99E7C865D3F1E224E4EF2864F6B40E2DDB2C39404D64DFE1E8D06F457C26F05EC78AAA7ECC48
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.A...y.G...z.V...|.\...}.n.....v.....{.........................................................................................V.................P.............................+.......................m.......................q.......................h.................1...................................A.....g...........9.....{.................I.......................r.................n...........R.....x...........,.....Y.....u.................5.....E.................!.....8.................=.....R.................:.....N.......................).....x.......................[.......................{...........1.....M.................1.....P.......................s...................................<.....w.................;.....T.................0.....E.................S.....o.........................................M.....w...........F.....y.................2.....Z.....m...........E.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ca.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\cs.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):492147
                                                                                                                                                                                                                                                      Entropy (8bit):5.821583344189851
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:970B5491E1AA5049CEDA1DFB16128622
                                                                                                                                                                                                                                                      SHA1:6F06849367017C2DB05664C254D6BB61701CB6A6
                                                                                                                                                                                                                                                      SHA-256:7E29CADD91A397B828AD02822A21F739509F075741B98A48B125AB785A2E8BD9
                                                                                                                                                                                                                                                      SHA-512:4A1D8DF4842E9C74670DD4540E0586B6BF55705EA03C59BD9DA0EC57D6D3F3B935D1B1CF0741ECC54D29C27997EF59ACECA086FA7DE11810DAB56C6240CCE34E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................k...........^.....|...........@.....u...................................m.................2.................(.....;.........................................(.....N..........._.................;.......................e...................................I.....^...........Y.......................h.......................A.....m.................!.....F.....W...........$.....].....q...........4.....i.....{...........%.....P.....]...........'....._.....r...........A.....{.........................................w.......................G.....h.................N.....z.................p.................6.......................3.......................`...................................G.....Y...........k.................I.......................S.......................W.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\cs.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\da.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):455012
                                                                                                                                                                                                                                                      Entropy (8bit):5.442077862801261
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F737DC0142DD0A0C1656F7838B6C6C22
                                                                                                                                                                                                                                                      SHA1:6548C88870480EE11440E5857CEECBFC9081077D
                                                                                                                                                                                                                                                      SHA-256:4B5FF741C86044752392F76C2C73EB3A8AA3B4154FAC3061E296CDC8705E20DD
                                                                                                                                                                                                                                                      SHA-512:7CE2C6E2DD858747D719B6A1F11B81F756604106EC0ED5ED3124F430BC8441CEF00ABA578C87A208EBDAB02D36D6408ECD97C53760EAD57F0BF8991FBABF46B8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.+...t.4...v.I...w.V...y.\...z.k...|.q...}.................................................................................................}...........4.....C...........%.....a.....y.............................R.......................R.......................8.......................5.......................]...................................D.....W...........,.....d.....x.............................~...........V.....|.........../.....Y.....k.................6.....D.............................}.................'.......................(.....|.......................`.......................B.......................N...........#.....;......................./.....y.......................T.......................Q.................3.......................&.................#.....8.................#.....9.................[.....i...........z.................F.......................2.............................p.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\da.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\de.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):488499
                                                                                                                                                                                                                                                      Entropy (8bit):5.474759797861145
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7ADBC0AD71B078AD5EC7B8415EE27C6A
                                                                                                                                                                                                                                                      SHA1:06020432DDD4AECAEFB0719129DE7D78213E3B75
                                                                                                                                                                                                                                                      SHA-256:12722ED220151EDC781D8ABA46587DE0D073F4223D95332302334E3AEC3508CE
                                                                                                                                                                                                                                                      SHA-512:C7A3C4ADA7B6D396A148FC1591A73A394EAFB9DF9FB6F34F092996501A1DFAE356332F95FF2900FDAB99ACDB5BA7787B1D4851E672703A471CA705FBC22D3AB7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.&...n.....o.3...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....|.....}...................................................................................../.....E...................................1.....n.................{.................\.................&.................?.....P...........:.....m...................................p...........2.....T...........U.....................................................o...........,........... .....?.................@.....U...........-.....X.....j...........?.....i.....z.............................T...................................0.....A...........&.....Y.....h...........Z.................9...........&.....<.................;.....R.................".....5.................1.....D...........\.........................................@.......................{...........'.....=...........K.................8.................%.................;.....P...........$.....M.....\...........[.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\de.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\el.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):840555
                                                                                                                                                                                                                                                      Entropy (8bit):4.911367033506793
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:774117B1BC4275950DB21A3CC257B31F
                                                                                                                                                                                                                                                      SHA1:524280B3CC64B09F1B21BB122867E99CD68B40C1
                                                                                                                                                                                                                                                      SHA-256:B411145A0DD1901A30CAC9AAD8697ADE6E08B1F22EAE84CBECBF6353FE317610
                                                                                                                                                                                                                                                      SHA-512:0B65AC91A75953FD0660A01ABF672418AFEFAEF8C3C541D64DBB7F03743E8C770311DAF66D9590FC73E4CF30F7F741262A8D156253ED5331B697C395DD22A61C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.?...y.E...z.T...|.Z...}.l.....t.....y.......................................................................0.....i...........n.....".....Z.....U.....$.............................o.................Z...........#...........f.............................a...........P...........o.......................?.....y.....K.............................H...................................G.....{.....s.....&.....`.......................8...................................S...........................................................9.................H.....o.....,...........>.....e..... ...........:.....[.....f.....n...........<.................8.....m...................................?.......................p...........D.................................................................8.....g.................b............ .....!.....!....="....M#....I$.....$.....$.....%.....&.....&.....'.....(.....).....)

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\el.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\en-GB.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):397719
                                                                                                                                                                                                                                                      Entropy (8bit):5.491741053176572
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:85CE8484B4F6D435AECA02833072A516
                                                                                                                                                                                                                                                      SHA1:82D4E7A528622BBCB8A11BEABBBFA45CAA7BC1C3
                                                                                                                                                                                                                                                      SHA-256:DA1DF4B23F91E67D134FA1388267244675604722DB427513178E1A2D3D0E2E78
                                                                                                                                                                                                                                                      SHA-512:F32A05527BBB9BBADDC6A9F14F8E28022FC7BA058177B86030FE06416298EAC47625782A44AB5F00EC22F242A234CFBC34D758F2397CD2837F6727B4F0E01FC7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........E!^.e.(...h.-...i.;...j.G...k.V...l.a...n.i...o.n...p.{...q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.....D.....S.....c.....t...........G.......................E.....v.................F.......................=.....l.......................<.....J.............................\.......................?.......................5.............................X.......................'.....S.....^...........'.....i.....}.............................[.............................>....._.....k.................E.....X.......................(.....q.......................2.....v.......................7.....`.....k...........$.....a.....v.................&.....<.............................D.............................Z.......................1.....L.....[.................3.....C................. .....8.................S.....a...........!.....X.....u.................C.....R.............................h.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\en-GB.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\en-US.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):400880
                                                                                                                                                                                                                                                      Entropy (8bit):5.486762809596193
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B6231DDA51F23A4D55D8A8D932306731
                                                                                                                                                                                                                                                      SHA1:6438BDD6480AF4B121AF5DD866D5BC56538F2C15
                                                                                                                                                                                                                                                      SHA-256:801A0FB4C70136C8BC4090B03C2DB1C0A727190AA50A591299C14D80221F8BDD
                                                                                                                                                                                                                                                      SHA-512:D3157F05D59C58E3308ADD148D2D1A305E92A7F8DF82C1666F106D23B5397D714BDAA9CC587E994C70846724D1891C02F2DD726CBD257DF5AAC13616F1AD3857
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........{!(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y.......................................................................J......................._.......................T.......................W.......................2.....w.......................:.....a.....n.................%.....<.................$.....<.............................l.......................:.......................$.............................N.....i.....x.............................\....................... .....n.......................J.....w.......................:.....E.............................M.......................'.......................".....a....................... .....@.....U.............................t.......................[.............................[.......................:.....r.................[.......................n.......................d.......................$.....F.....V................./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\en-US.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\es-419.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):478832
                                                                                                                                                                                                                                                      Entropy (8bit):5.361091507641052
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F1D1F507FF171B5343FEB49552B131B6
                                                                                                                                                                                                                                                      SHA1:6D0E85E85E6EA09FBAF00BE892E2FBC83EFF36BB
                                                                                                                                                                                                                                                      SHA-256:EBF4E6DEABD663C108D1EA708F2B85CCBE69BB8E7819137ABD93916D67DB5031
                                                                                                                                                                                                                                                      SHA-512:2B0254AC6612A8384B01D400AB4BFE743702AC061BC48FBDF1E79291A45B8737202EACB8117E3915A1E704D99CA3B99F650C98532508FBE26538C1DFA96BAB08
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.............................................................................................................................|.................m...........J.....h...........U.......................U.......................O.....w...............................................5....._...........<.......................i.................<.............................$.....}.................;.....j.................0.....^.....m.........../.....e.....{...........X.......................t.......................j.......................O.......................W.................(.......................l.......................v.................]...................................<.....}...........,.....R.....l...........-.....b.....{...........H.................=...........$.....;...........A.................6.......................H.......................J.................#.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\es-419.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\es.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):478165
                                                                                                                                                                                                                                                      Entropy (8bit):5.349796633731915
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:07BB68F58F393361DA76BE2834C07D5E
                                                                                                                                                                                                                                                      SHA1:F6358616A346C0266F00067D95BEB356A2985BFA
                                                                                                                                                                                                                                                      SHA-256:C0913E46AC7CA5D0A5E2B50E006376FD355083A5E6903AB4624539CFD0CC7931
                                                                                                                                                                                                                                                      SHA-512:14ABCA4E424FFFA33197FD4CF23EE3DBA655744FA572729804590444DC980ED52053EE06328DE1164E10943EEBC74A24A182DA8CA31EC7A612378540BC178AE8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.......................................................................................................B.................,...................................}.................z.................).......................'.......................N.................2...........,.....m.................c.................".......................W.................,...........:.......................b.......................W.......................Q.......................i.......................d.......................Q.......................6.....e.....o...........-.....\.....l...........Z.......................q.......................k.................+.......................X.................H.......................2.................".....5.................U.....o.........................................Q.....z...........].......................W.....}.................a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\es.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\et.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):438600
                                                                                                                                                                                                                                                      Entropy (8bit):5.465230664544145
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4CFEEA84F6C770853D931318A2F70809
                                                                                                                                                                                                                                                      SHA1:D63B2641A4971F53878E4B4BAD1790E89CA339DB
                                                                                                                                                                                                                                                      SHA-256:838E50C45EFA4D9AD171B76030F8DEA5A863B7082D212A9471F315C3217650E2
                                                                                                                                                                                                                                                      SHA-512:386EFE5EE41B912C45AB4C06716BD9CE95A3F44E5B2C5E8EBCFF544A1658835358286BD648A090AB093084BC5738579EAA02E5441CAFA156DE42F1B35A894B25
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.&...s.7...t.@...v.U...w.b...y.h...z.w...|.}...}.......................................................................................................3.......................y.................+.......................N.......................N.......................@.......................B.......................R.......................|.................$.......................,.......................F...........;.......................\.....~.................B.....e.....q...........&.....P.....`.................h.....s...........:.....t.................;.....l.....t...........4.....g.....v...........5.....i.....q...........Y.......................Z.....y.................M.....q.................A.....y.................N.......................Q.....k.....|...........@.....h.................L.....................................................N.....s...........O.......................2.....N.....b...........0.....^.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\et.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fa.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):682352
                                                                                                                                                                                                                                                      Entropy (8bit):5.204779136758079
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2A426E8D45A0A93E89F696D8273CEFA3
                                                                                                                                                                                                                                                      SHA1:7B0AEE5D20229528A2FF084D1AFBB72EC18ED007
                                                                                                                                                                                                                                                      SHA-256:397D75FDE14D602013C79CDF3915B932C27D9BF60C3F141979276A0E7CCA3D72
                                                                                                                                                                                                                                                      SHA-512:192027A1D34580212A610C3693983259CA47FB690A59A01B75914748C536B24F6036D65D8EF03E328E731614B3CE599C01EF183FDBC1139F5BF4AF26E209ECC5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.(...h.-...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................&.....-...../.....4.....N.....j.......................q.......................v...........................................................*...........t.................f...........L.....m...................................x.......................%.....n...........'.................3.......................4.................S.....w.............................U.................*...........J.................:...........*.....?...........i.................G................. ...........<.....{...........).............................r.................u...........'.....J...................................8.................g...........X.........................................5.................O...........-.....N.....L.....D.......................w.......................b.................\.................%...........p.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fa.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fi.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):443450
                                                                                                                                                                                                                                                      Entropy (8bit):5.435390021245669
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D8BE3F4659DCC5C615D2FDCA9D946DC9
                                                                                                                                                                                                                                                      SHA1:35B6B72D139FCE62588E3F90C924B2786DA1E777
                                                                                                                                                                                                                                                      SHA-256:14BA0AE27E32F7FCDA131A86DA7D4734D4422D7631A5AED1BB15AD2708F486F0
                                                                                                                                                                                                                                                      SHA-512:72250508EC81501B4873A77DAF460EA15E220D8E5E15E67F2A0CD8CBAC05BC2A225117C100B8AEC2ABF60D70CC8E7EF44C618F85900F5A71035B9FA679859AFD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.D...h.I...i.Z...j.f...k.u...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............".....*.....2.....:.....A.....H.....O.....P.....Q.....V.....h.....y.................,.......................{...................................5.....K.................R.....g.................A.....O.............................r.......................y...........&.....@.......................4.................#.....8.................&.....D.................u.................9.....\.....s................./.....=.............................M.......................,............................._.......................D.....r.................#.....L.....V...........6.....}.................(.....D.....Z.................*.....C.................*.....9.................<.....f.............................x.......................y...................................i.....~...........G.....{.................R.............................0.....@...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fi.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fil.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):496128
                                                                                                                                                                                                                                                      Entropy (8bit):5.216025914519826
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D37D74C65F9EC441127936F59D8C3D6D
                                                                                                                                                                                                                                                      SHA1:7A427E8DDFA7BD06F5B81BBFCA4713BF34344817
                                                                                                                                                                                                                                                      SHA-256:2F1D68EB778D108812F3C02697B36EDD91B788F86F83BFF84E7C6DC1C7645200
                                                                                                                                                                                                                                                      SHA-512:5F0B061C038CB63EB00A4AB6D9FF6CD96793FE33AEE61DD01E4AC0ABF088B9ED1BC24886DAA19C3B2EF9447281E8B20553B357043BE1634D39E9E7D2E63080CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........j!9.e.r...h.w...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................z...........i.................~.............................m...................................G.......................T...................................H.....w.............................|...........:.....P...........:.....w...............................................q.................R.....}.................H.....p.....}...........1.....[.....j...........G.......................d.......................l.......................m.......................o.................,.........................................,.....{.......................k...................................M.................K.....u.................m.................I................. ...........T.................c...........2.....c...........C.....y.................I.....q.................}.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fil.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fr.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513870
                                                                                                                                                                                                                                                      Entropy (8bit):5.378965610026006
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4B9AF14389C7331028D6785CD81DF730
                                                                                                                                                                                                                                                      SHA1:8DE60A81818B41542F74924F837CD4961DBCBFA0
                                                                                                                                                                                                                                                      SHA-256:0C87E104EE1977CF2D7A33A8C95A37C3BB91D558A3C63DACB759E4AD78B580DB
                                                                                                                                                                                                                                                      SHA-512:07EAFF515A138B08AD4CFA1017ECE90A0E5B7C2A4C13451E1A13DA449393793E8158B048E9DF7A77EE34A67C0765F613E3D9809182F0370D72EADA790D175F40
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...|.I...}.[.....c.....h.....p.....x.......................................................................}.....$.................1...................................s.................j.................<.......................A...................................3.....a...........L.........................................I...................................7.....P...........t.................R.......................S.......................M.......................e.......................~.................-.............................n.......................g...................................v.................S.......................7.....W.....u...........>.....{.........../.................%.....~.......................~...........(.....D...........0.....}...............................................:.....a...........l.................-.......................@.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\fr.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\gu.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):960557
                                                                                                                                                                                                                                                      Entropy (8bit):4.489329939358189
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:66EC4FD80F9F253BC30B090331995465
                                                                                                                                                                                                                                                      SHA1:A94482524B1E17688086D71B8605F7568DD25BC4
                                                                                                                                                                                                                                                      SHA-256:56008F3DCCE5762ECD33D20E59204D5F770E37C84681965D1BE5F8E9BA6358C1
                                                                                                                                                                                                                                                      SHA-512:CE063A7FB21AF761291A7F533E144C3AA95A5EB3DB1B83466BB812520781DD0249183F54640C0577C6322D4F0DF6D42323CABADFA11A48230D9EC0928B107E7D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.=...y.C...z.R...|.X...}.j.....r.....w.............................................................................U................._.................O.................;.........................................A...........v.......................2.......................J...............................................q.............................:.....f.....c.....^........... .....C.....Q...........9...........c.......................=.....t...........D...........4.....M.................2.....].................4.....V...................................r.......................H.........................................z.....,.................0...................................%.....K.....V.....!.......................h.....................................................b.................................... .....!....k".....".....#....w$.....$.....%.....%.....&.....'....)'....H(....%).....)

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\gu.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\he.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):608626
                                                                                                                                                                                                                                                      Entropy (8bit):4.82273829135184
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8B100F59DE6BFA0570C269393665E573
                                                                                                                                                                                                                                                      SHA1:9C56E0473141E7C9D7AFB9B9F3E28D2B349188B5
                                                                                                                                                                                                                                                      SHA-256:A47260E19DCF4662BD68A3E35C8C444187621F82ED11790D7058A6D71FBB5D1B
                                                                                                                                                                                                                                                      SHA-512:B258A6C7D7AD2DEEEC614635883B3C3648208590D436847E685F9D1B14C21C427B462CBECCC8E3570FAC14CE671EBAF50BAAB1807E341E89D57300F627D415DD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w. ...y.&...z.5...|.;...}.M.....U.....Z.....b.....j.....r.....y.................................................................l.............................^.....w.....*.................=...........E.................;.......................~.................?...........:.....v...........A.................3...........S.................O.............................$.....q...........G...........X.....~...........d.................8...................................Z.....q...........c.................9.......................{...........#.....4.................Y.....l...........X.................G.................>...........&.....T.....x...........L.....w...........)...................................[.................`.......................}.................m.........../.....W.....)...........Y.....}.....'.............................O.................F.............................E.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\he.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\hi.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1014023
                                                                                                                                                                                                                                                      Entropy (8bit):4.4638980035455464
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:13E9EC33038D954611274C6CF34AC017
                                                                                                                                                                                                                                                      SHA1:915D31F27F7F9080732DFFB38D99D9DECA2665C2
                                                                                                                                                                                                                                                      SHA-256:7BF84B5A8DCC3E72F28257D1FD6FE1F3105E82631599D6046B5BBE45A5D8D7A9
                                                                                                                                                                                                                                                      SHA-512:844D52768437E639213390F5D15FA5CCE0E1789C69AE49CB722CD0BED9E10667F308EBA0233F98F92E76CFCE342B7395CF53390DD8F62AA42A24409180241A0F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.3...i.D...j.P...k._...l.j...n.r...o.w...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................$.....+.....2.....9.....:.....;.....=....._...........................................................t.............................E.....8.............................C...............................................8.............................E...........k.....-.......................d...............................................................................................o.............................Z.....s.....J...........o..........._...........q...........@...........@.....\...................................................................................0.....}...........D.............................{...........+.................N...........\...........+.....j.....^.....:.............................O.................. .....!....8!....F".....#.....#.....#.....%.....%.....&.....&.....'.....(.....)....G)....D*.....+.....+

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\hi.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\hr.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):477955
                                                                                                                                                                                                                                                      Entropy (8bit):5.515444008768555
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:926310EEC6F3B1AEEB9901BD8DB5FA5D
                                                                                                                                                                                                                                                      SHA1:42A3D4FF43741BE567CD0F713CD0023D48F7CF68
                                                                                                                                                                                                                                                      SHA-256:A3F68D44DA13E7A2BBFCC60F80D43EBF6CD3CC1877345F882CB1A9B086F3B732
                                                                                                                                                                                                                                                      SHA-512:478FE4A6A27F91A3B904D6DF95D61DDDA47BAC0BC60F9A809E2463E3E8395EF9FF764A13F4EA7D4A74E86F893187220752FBF75CF4E644B2DE50EAFE97926344
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.S...t.\...v.q...w.~...y.....z.....|.....}........................................................................................... ...........L.................9.......................l...........,.....K.................[.....q...........+.....].....m.................;.....K.................P.....u...........r.................M.......................t...................................U.....p.............................n.......................L.............................^.......................R.......................M.....{.................U.......................J.....u.................0.....].....m...........].......................c.......................I.....h.................1.....^.....u...........T.................'.....v.................".....~.................P.............................%.....}.................w.................B.......................0.....y...............................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\hr.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\hu.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):514501
                                                                                                                                                                                                                                                      Entropy (8bit):5.639969437567393
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5B2A9EF5398E6E2F0FDA674BCB1F1493
                                                                                                                                                                                                                                                      SHA1:9254CE803625B66690B106D24232DE80C46DD9AC
                                                                                                                                                                                                                                                      SHA-256:11EBCD04B8DA2D95CAB4DAF863F3149C16DF088D8BB463D9BF8B04814FE53D05
                                                                                                                                                                                                                                                      SHA-512:7E08D1B7634C019699C5DFC9A61E8790655BE4AF1695E1C2C4E487C2B6A9C2BBE8EDBF51EC5256A77890AC97D87A181CDDDCF528C02EA418ABE2FBAB44AE84BC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.x...h.}...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y. ...z./...|.5...}.G.....O.....T.....\.....d.....l.....s.....z...........................................................5.................9...................................}...................................K.......................Y................. ........... .....^...........*.................3.................Y.....k...........R.................*.............................*.........................................C.......................Z.............................8.....~...................................o...........G.....\...........I.........................................t...........Y.....o...........S.....z.................a.......................}.................e........... .....W.................0.....H.................8.....N...........A.................@...........V.....e.........................................k.................U.................(.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\hu.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\id.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):429060
                                                                                                                                                                                                                                                      Entropy (8bit):5.382923282966039
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:37551F46F9D37B93562375FB0A9FB258
                                                                                                                                                                                                                                                      SHA1:A8492C2D30C50CF453D54AA5B133326A8C481A19
                                                                                                                                                                                                                                                      SHA-256:D6E3A3EC7DA8E6C32D010DD00D39AB26E2A4C652C3AA40F7DF3D623C38E5478E
                                                                                                                                                                                                                                                      SHA-512:BBAFF7029365ADD25F9737DECA09A2C544499D0C11C8023FF572A1F7C106F597214B3BF8B013A27C99E1EDC2F6D4DEA9492EA957D5315F3CF819467AE7D15FC0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...|.I...}.[.....c.....h.....p.....x.......................................................................Q.......................q.......................b.......................~.................$............................._.......................I.......................Q.......................E.............................p.......................p.................2.......................9.....v.......................5.....Z.....f.................(.....2....................... .....t.......................O.......................'.....v.......................].......................P.............................9.....J.............................s.......................T.......................8.....t.......................N.....|.................G.........................................j.......................}.......................S.......................).............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\id.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-00MUG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-00O9P.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):608626
                                                                                                                                                                                                                                                      Entropy (8bit):4.82273829135184
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8B100F59DE6BFA0570C269393665E573
                                                                                                                                                                                                                                                      SHA1:9C56E0473141E7C9D7AFB9B9F3E28D2B349188B5
                                                                                                                                                                                                                                                      SHA-256:A47260E19DCF4662BD68A3E35C8C444187621F82ED11790D7058A6D71FBB5D1B
                                                                                                                                                                                                                                                      SHA-512:B258A6C7D7AD2DEEEC614635883B3C3648208590D436847E685F9D1B14C21C427B462CBECCC8E3570FAC14CE671EBAF50BAAB1807E341E89D57300F627D415DD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.|...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w. ...y.&...z.5...|.;...}.M.....U.....Z.....b.....j.....r.....y.................................................................l.............................^.....w.....*.................=...........E.................;.......................~.................?...........:.....v...........A.................3...........S.................O.............................$.....q...........G...........X.....~...........d.................8...................................Z.....q...........c.................9.......................{...........#.....4.................Y.....l...........X.................G.................>...........&.....T.....x...........L.....w...........)...................................[.................`.......................}.................m.........../.....W.....)...........Y.....}.....'.............................O.................F.............................E.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-0DNV7.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-0RRKA.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-0TFP2.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-1AMIA.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-1JMCG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):403888
                                                                                                                                                                                                                                                      Entropy (8bit):6.760833853560909
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A011C6D7FD33D1B8E1EE165D57F8070A
                                                                                                                                                                                                                                                      SHA1:9F91B7E9E065851E98DCF1766077C704429EE632
                                                                                                                                                                                                                                                      SHA-256:389E601EC1D00D91FFE0D483C7BA8E3DCC86473A78AB24FA4FE2FBCD3C9478F6
                                                                                                                                                                                                                                                      SHA-512:010262B1B2FC6BF85F4C8F6FE91F28F999C3466746BA981028FE458CC909DD9713CD85FE349CC4648D713A91158E8EDCCBE1B884BE52EA0739BC0C6D91F4003D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... !.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{.................................................................I.......................e.......................Q.......................M.......................5.............................[.....|.................9....._.....y...........6.....e.....z...........-.....[.....h.................9.....E.................@.....R...........*.....h.....z.............................x.......................@.............................i.......................F.....o.....{.........../.....^.....j.................8.....A.............................................../.....{.......................A.......................[.......................D.....u.......................2.....>.................................................................N.....]...........,.....d.....y.........../.....X.....d.............................^.......................N.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-1TV3E.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-21FQR.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-25V9L.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):469212
                                                                                                                                                                                                                                                      Entropy (8bit):5.427870477463905
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E76567E7CB1781755DF1C9EF3194167B
                                                                                                                                                                                                                                                      SHA1:295D083D51A2DFCDD1232945ADAC38EDBDF37CC5
                                                                                                                                                                                                                                                      SHA-256:6BF374CA987034769785EBB94DD4162B53924F83E8923D5EA3AA4E109068AA11
                                                                                                                                                                                                                                                      SHA-512:E0564D5A041C4A17AD9690B67857698C135852E8E220EDC1CC3C6B7E532752D2279470C8E38F0F055033EEB98E7FCEF46137DC562D8866836B9CD7948A2EFDC6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.(...s.9...t.B...v.W...w.d...y.j...z.y...|.....}...........................................................................................+...........@.................!.......................`...........L.....i.................h.....}...........#.....M.....].................<.....U...........I.................E.................#.................;.....L.................Q.....e...........S.................K.................;.............................j.......................h.......................k.......................n.......................P.......................*.....~.......................s.................@.................".....u.......................D.......................g.................;.................;....................... .....k.................$.....u................._...........3.....I...........J.................#.....q.......................I.....o.................\.................*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-2G32C.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-2KK8O.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):492147
                                                                                                                                                                                                                                                      Entropy (8bit):5.821583344189851
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:970B5491E1AA5049CEDA1DFB16128622
                                                                                                                                                                                                                                                      SHA1:6F06849367017C2DB05664C254D6BB61701CB6A6
                                                                                                                                                                                                                                                      SHA-256:7E29CADD91A397B828AD02822A21F739509F075741B98A48B125AB785A2E8BD9
                                                                                                                                                                                                                                                      SHA-512:4A1D8DF4842E9C74670DD4540E0586B6BF55705EA03C59BD9DA0EC57D6D3F3B935D1B1CF0741ECC54D29C27997EF59ACECA086FA7DE11810DAB56C6240CCE34E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................k...........^.....|...........@.....u...................................m.................2.................(.....;.........................................(.....N..........._.................;.......................e...................................I.....^...........Y.......................h.......................A.....m.................!.....F.....W...........$.....].....q...........4.....i.....{...........%.....P.....]...........'....._.....r...........A.....{.........................................w.......................G.....h.................N.....z.................p.................6.......................3.......................`...................................G.....Y...........k.................I.......................S.......................W.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-2MFRN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-3OQ57.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-41FK1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-47L6I.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):432343
                                                                                                                                                                                                                                                      Entropy (8bit):5.405941245339364
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2978C77C9FC9D3313A63445F7A994DBA
                                                                                                                                                                                                                                                      SHA1:32DCA3E90B72B10415056C5B52A160643A6DB4DB
                                                                                                                                                                                                                                                      SHA-256:760FBF527F137ACEE407B0F30520081A2C11E8749B74D8F3C47499287EE06C4A
                                                                                                                                                                                                                                                      SHA-512:98B296A62A6E429A694FE4AF161A977A0F239A288B586ABB95DE3BB7875F34AFA71EB245D2C8C2408543C57F836F029329053CD3CC1B4228BC442EC35CA8471C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|.........................................................................................x...........4.....E.................7.....H...........#.....g.....|...........B.....w................./.....X.....f.................9.....I.................4.....S.................N.....k...........%.....Y.....k.................U.....d...........5.....s.................q.................%.....f.......................(.....K.....X.............................h.......................^.......................D.............................U.....|.......................G.....P...........8.......................5.....Y.....q.................9.....T.......................'.................=.....o.................&.....9.......................$.......................8...........9.......................|.................M.......................4.....x.......................X.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-4F30D.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-4KBIE.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):840555
                                                                                                                                                                                                                                                      Entropy (8bit):4.911367033506793
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:774117B1BC4275950DB21A3CC257B31F
                                                                                                                                                                                                                                                      SHA1:524280B3CC64B09F1B21BB122867E99CD68B40C1
                                                                                                                                                                                                                                                      SHA-256:B411145A0DD1901A30CAC9AAD8697ADE6E08B1F22EAE84CBECBF6353FE317610
                                                                                                                                                                                                                                                      SHA-512:0B65AC91A75953FD0660A01ABF672418AFEFAEF8C3C541D64DBB7F03743E8C770311DAF66D9590FC73E4CF30F7F741262A8D156253ED5331B697C395DD22A61C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.2...w.?...y.E...z.T...|.Z...}.l.....t.....y.......................................................................0.....i...........n.....".....Z.....U.....$.............................o.................Z...........#...........f.............................a...........P...........o.......................?.....y.....K.............................H...................................G.....{.....s.....&.....`.......................8...................................S...........................................................9.................H.....o.....,...........>.....e..... ...........:.....[.....f.....n...........<.................8.....m...................................?.......................p...........D.................................................................8.....g.................b............ .....!.....!....="....M#....I$.....$.....$.....%.....&.....&.....'.....(.....).....)

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-4NSAK.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):478637
                                                                                                                                                                                                                                                      Entropy (8bit):5.28216096924835
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:34496B477B0AFBCB9671DB428AA7C9BA
                                                                                                                                                                                                                                                      SHA1:24B8989C23E384C0AA2323FA4FB9291FEEBE76B9
                                                                                                                                                                                                                                                      SHA-256:5277EC6DFDBF84D9D15FBC75CC5BE02E9F75E434256D52F3D96C4AE21EFCFF75
                                                                                                                                                                                                                                                      SHA-512:6A744E7E079137811BAD95C9C763DFE91C008F29833C86E1CFAAF3075675B90F48B75E2586A2C91663904141326F0CA512E9B10163F071B4A96C6103D4DB2733
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.$...r.0...s.A...t.J...v._...w.l...y.r...z.....|.....}...........................................................................................#...........;.........................................c...........<.....X...........M.......................Y.......................).....U.....d...........@.....}...........)...................................2.....C.................=.....S...........*.....p...................................X.......................>.............................Q.....x.................M.......................H.....{.................#.....Q.....Z.................%...............................................D.....].................).....B.............................J.......................Y.................6.............................o.......................{...........#.....I...........`.................m...........%.....O...........<.......................+.....M.....`...........-.....k.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-4T965.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):886579
                                                                                                                                                                                                                                                      Entropy (8bit):4.532231807164053
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7780E4EE7B6D1AB4379067C48F4CF159
                                                                                                                                                                                                                                                      SHA1:4EFA8BEB4F484C5BBF0F192BC30994DBC5D83EFE
                                                                                                                                                                                                                                                      SHA-256:696712F742A3DBE2310927548A3AB80E5C5A4CB1F31669A814851316C162AEC7
                                                                                                                                                                                                                                                      SHA-512:85A94547E56574D97A58D9A6C3AA91337D11C8FA9D48AF20CDF36F1FAC398C8B5FB30E0C4DE03CBB8E39098B52436837937E6FE316651B1DC9E408AD58D634F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........V M.e.J...h.O...i.W...j.b...k.q...l.w...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................'...../.....4.....<.....C.....J.....Q.....S.....X.....|.................?.....\.....9........................................."...................................~...........q...........>....._...........{.............................<.................?.......................s.........................................................../.....g.....V...........T.....3.................Y.....%...........@.....a.....!.................0.................8.....b.....4...........U.....y.....E...........f...........@...........5.....P.....%...........F.....m.................H.....p.....*................./...........k.............................p.................u...........{..... .............................].......................l...........1.....4.......................3.....$...........E ....8!.....!....i"....."....O#.....#....B$....a$....j%....3&.....&

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-5FJTG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-60CNO.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):468536
                                                                                                                                                                                                                                                      Entropy (8bit):5.616090976999539
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1BA9F7E1C5E827860D0629014D756A00
                                                                                                                                                                                                                                                      SHA1:DBB92B8901709F41FA85E6C2A6196C44BF3FDC13
                                                                                                                                                                                                                                                      SHA-256:6D157F326C9F0088C1580D5B3DB5BE1546A2C7FF0C860074F55B2CA1085E88F0
                                                                                                                                                                                                                                                      SHA-512:6DCF8583F1FCEAD60C140AF62E48B16AD671C42C2AC2438A08CC80385B3EB4C9D8D252952B04871CCF334BF06324FA822F1AAAA99CBF7A06788BD34D3F0F54F3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........"!..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.....................................................................................2.....L...........o.................N...................................C.....^.................Z.....m.................=.....L................./.....A.................C.....e...........X.......................}.......................t.................).......................t...........,.....D.......................J.................8.....I.................3.....C.................E.....R...........!.....X.....i...........*.....\.....i...........%.....U.....a...........&.....Z.....g...........l.................>.......................?.............................s.................2.......................P.......................7.......................O.............................M.................e...........!.....E...........K.......................q.................+.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-63M1C.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-64HDN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-65P7O.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-6FC72.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513942
                                                                                                                                                                                                                                                      Entropy (8bit):5.626142284867624
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:70E7E0E790C4B738708230DCD236EFA7
                                                                                                                                                                                                                                                      SHA1:81B7AA5935AB339EF420D7943415A96670FFB1C5
                                                                                                                                                                                                                                                      SHA-256:3962C3C701848B47BF924AD128A8D5BF36A963C947E2CCFA1605B189408B62F2
                                                                                                                                                                                                                                                      SHA-512:5B185022F640B381C51A07806E50451834A909A1475FF4357A71960992E3B574EA89FA20C674810A976578A9F66435A25C2FEFFF8C935AB58E32018CBCBBB3CA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.+...t.4...v.I...w.V...y.\...z.k...|.q...}.......................................................................................................0.................&.............................9.........................................e.................,...........(.....`.....w...........q.................T...........$.....>.................e.....v...........d.................A................."...........G.........................................D.......................o.................0...........*.....f.....y...........m.................3...................................8.....I...........0.....d.....r.........................................).....I...........Z.................9...................................K.....~...........U.....w...........(.............................!.....k.......................*.....B...........K.................G........... .....1.......................&...........:.....{.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-6HJLD.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):496128
                                                                                                                                                                                                                                                      Entropy (8bit):5.216025914519826
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D37D74C65F9EC441127936F59D8C3D6D
                                                                                                                                                                                                                                                      SHA1:7A427E8DDFA7BD06F5B81BBFCA4713BF34344817
                                                                                                                                                                                                                                                      SHA-256:2F1D68EB778D108812F3C02697B36EDD91B788F86F83BFF84E7C6DC1C7645200
                                                                                                                                                                                                                                                      SHA-512:5F0B061C038CB63EB00A4AB6D9FF6CD96793FE33AEE61DD01E4AC0ABF088B9ED1BC24886DAA19C3B2EF9447281E8B20553B357043BE1634D39E9E7D2E63080CC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........j!9.e.r...h.w...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.!...z.0...|.6...}.H.....P.....U.....].....e.....m.....t.....{.....................................................z...........i.................~.............................m...................................G.......................T...................................H.....w.............................|...........:.....P...........:.....w...............................................q.................R.....}.................H.....p.....}...........1.....[.....j...........G.......................d.......................l.......................m.......................o.................,.........................................,.....{.......................k...................................M.................K.....u.................m.................I................. ...........T.................c...........2.....c...........C.....y.................I.....q.................}.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-6VVLD.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):443450
                                                                                                                                                                                                                                                      Entropy (8bit):5.435390021245669
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D8BE3F4659DCC5C615D2FDCA9D946DC9
                                                                                                                                                                                                                                                      SHA1:35B6B72D139FCE62588E3F90C924B2786DA1E777
                                                                                                                                                                                                                                                      SHA-256:14BA0AE27E32F7FCDA131A86DA7D4734D4422D7631A5AED1BB15AD2708F486F0
                                                                                                                                                                                                                                                      SHA-512:72250508EC81501B4873A77DAF460EA15E220D8E5E15E67F2A0CD8CBAC05BC2A225117C100B8AEC2ABF60D70CC8E7EF44C618F85900F5A71035B9FA679859AFD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.D...h.I...i.Z...j.f...k.u...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.............".....*.....2.....:.....A.....H.....O.....P.....Q.....V.....h.....y.................,.......................{...................................5.....K.................R.....g.................A.....O.............................r.......................y...........&.....@.......................4.................#.....8.................&.....D.................u.................9.....\.....s................./.....=.............................M.......................,............................._.......................D.....r.................#.....L.....V...........6.....}.................(.....D.....Z.................*.....C.................*.....9.................<.....f.............................x.......................y...................................i.....~...........G.....{.................R.............................0.....@...................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-719BN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):483029
                                                                                                                                                                                                                                                      Entropy (8bit):6.190574567732633
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1A20D15C10E4E71EED2E17BB45682BFE
                                                                                                                                                                                                                                                      SHA1:B4CD02FF581802B91241FDA83F1038CC89C91C34
                                                                                                                                                                                                                                                      SHA-256:4AA01FD54571F1DD0B8CD680FFAE28F22DB69DDC0007644DA5F8589AB8D79930
                                                                                                                                                                                                                                                      SHA-512:F016F32A8DDD109F0F414EF9C7F4C74CDE70389E9D9E2F5534BC4717FFFEE43DA10158FB13D383E6FB567EC671D6AC3057D9992141B141A7228500B2E1E54AEF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........E ^.e.(...h.-...i.>...j.I...k.V...l.^...m.f...o.l...p.s...q.y...r.....s.....t.....y.....z.....|.....}.......................................................%.....'.....,.....8.....H.....[.....k..........._.................6.......................i.................1.................C.....W.................J.....Z.................M.....`...........+.....P.....k...........I.....~.................M.....{.................?.....k.....x...........J.........................................^.......................>.............................g.........................................A.......................L.......................S.......................P.......................n...........).....=.......................&.......................,.......................*.................Z.......................,.....9.................#.....6................. .....;...........9.......................f.......................v.......................k.......................`................. .

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-75UFS.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):488499
                                                                                                                                                                                                                                                      Entropy (8bit):5.474759797861145
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7ADBC0AD71B078AD5EC7B8415EE27C6A
                                                                                                                                                                                                                                                      SHA1:06020432DDD4AECAEFB0719129DE7D78213E3B75
                                                                                                                                                                                                                                                      SHA-256:12722ED220151EDC781D8ABA46587DE0D073F4223D95332302334E3AEC3508CE
                                                                                                                                                                                                                                                      SHA-512:C7A3C4ADA7B6D396A148FC1591A73A394EAFB9DF9FB6F34F092996501A1DFAE356332F95FF2900FDAB99ACDB5BA7787B1D4851E672703A471CA705FBC22D3AB7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.&...n.....o.3...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....|.....}...................................................................................../.....E...................................1.....n.................{.................\.................&.................?.....P...........:.....m...................................p...........2.....T...........U.....................................................o...........,........... .....?.................@.....U...........-.....X.....j...........?.....i.....z.............................T...................................0.....A...........&.....Y.....h...........Z.................9...........&.....<.................;.....R.................".....5.................1.....D...........\.........................................@.......................{...........'.....=...........K.................8.................%.................;.....P...........$.....M.....\...........[.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-7CH8T.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):451052
                                                                                                                                                                                                                                                      Entropy (8bit):5.363007925700961
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:13F0961EC531CDFB00AEEAD580C6B8BF
                                                                                                                                                                                                                                                      SHA1:CA4872915B8E6F4FF77E022C3C2E151552E0C68B
                                                                                                                                                                                                                                                      SHA-256:B9065BD8ABF6BEA1DE64EF534E4BAEC419F422EF21189D9FE7D42FE949C4A70B
                                                                                                                                                                                                                                                      SHA-512:1BC850224C94128546B5BAA614686A0C59D8FD9E2376845EE8F819CC7D39BDB7625F1EA2C9C4F0FFBE0F1C9357DC2D86355B567543390459B3D73D0A02C0EFAB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.!...t.*...v.?...w.L...y.R...z.a...|.g...}.y...........................................................................................................N.....c...........2.....o.................j.........................................3.............................n.......................|.................L.......................c.......................l...................................A.....W...........K.......................N.....r.................!.....E.....S.................!.....2.................0.....A................. ...........~.......................[.......................H.......................[.......................}.......................n.......................Q.......................U.......................q.......................S.......................r.................%...........).......................~.................R.......................I.......................7.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-7E273.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):400880
                                                                                                                                                                                                                                                      Entropy (8bit):5.486762809596193
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B6231DDA51F23A4D55D8A8D932306731
                                                                                                                                                                                                                                                      SHA1:6438BDD6480AF4B121AF5DD866D5BC56538F2C15
                                                                                                                                                                                                                                                      SHA-256:801A0FB4C70136C8BC4090B03C2DB1C0A727190AA50A591299C14D80221F8BDD
                                                                                                                                                                                                                                                      SHA-512:D3157F05D59C58E3308ADD148D2D1A305E92A7F8DF82C1666F106D23B5397D714BDAA9CC587E994C70846724D1891C02F2DD726CBD257DF5AAC13616F1AD3857
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........{!(.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...|.J...}.\.....d.....i.....q.....y.......................................................................J......................._.......................T.......................W.......................2.....w.......................:.....a.....n.................%.....<.................$.....<.............................l.......................:.......................$.............................N.....i.....x.............................\....................... .....n.......................J.....w.......................:.....E.............................M.......................'.......................".....a....................... .....@.....U.............................t.......................[.............................[.......................:.....r.................[.......................n.......................d.......................$.....F.....V................./.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-837EN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-8CG02.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-8UQTC.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1136176
                                                                                                                                                                                                                                                      Entropy (8bit):4.421789550677631
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E3DEA39A4A8CFE525CEEF90EAA6F0D84
                                                                                                                                                                                                                                                      SHA1:9CE3048C9B0443D255F2877667356FEFC59901A5
                                                                                                                                                                                                                                                      SHA-256:404713A5F7C244AA7D35C92BD10B54C7D6A6523F64966849DDAD362355B56671
                                                                                                                                                                                                                                                      SHA-512:E89DD594AE0CA30984186F03CC9A055F856A0E3AE27906A1EF091111342AC70D008DF71E957466F29EC5D2CBBC13052C16FC739118B5C185A5BB819DFF2A1A07
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q. ...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...............................................................................S.................E...........r...................................T.................................................................M.....>...................................).....x.................................................................d.....................................................#...............................................A.................%.....Y.....;.............................:...................................H.....4.............................Z.......................0...........4.................P...........M...........A..........._....., ..... .....!....3".....#.....#....9$.....%.....%....E&.....&.....'.....(....?).....).....*.....+....:,.....,.....-.........../...../.....1.....2.....2.....3....\4....W5.....5....J6....;7.....8.....8.....8.....:....+;.....<

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-936C4.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):478832
                                                                                                                                                                                                                                                      Entropy (8bit):5.361091507641052
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F1D1F507FF171B5343FEB49552B131B6
                                                                                                                                                                                                                                                      SHA1:6D0E85E85E6EA09FBAF00BE892E2FBC83EFF36BB
                                                                                                                                                                                                                                                      SHA-256:EBF4E6DEABD663C108D1EA708F2B85CCBE69BB8E7819137ABD93916D67DB5031
                                                                                                                                                                                                                                                      SHA-512:2B0254AC6612A8384B01D400AB4BFE743702AC061BC48FBDF1E79291A45B8737202EACB8117E3915A1E704D99CA3B99F650C98532508FBE26538C1DFA96BAB08
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.(...v.=...w.J...y.P...z._...|.e...}.w.............................................................................................................................|.................m...........J.....h...........U.......................U.......................O.....w...............................................5....._...........<.......................i.................<.............................$.....}.................;.....j.................0.....^.....m.........../.....e.....{...........X.......................t.......................j.......................O.......................W.................(.......................l.......................v.................]...................................<.....}...........,.....R.....l...........-.....b.....{...........H.................=...........$.....;...........A.................6.......................H.......................J.................#.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-9DQ4G.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-9LUO5.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-9RDUL.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-AC6UD.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-AEA8U.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1048884
                                                                                                                                                                                                                                                      Entropy (8bit):4.462517009279803
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:273290F2F03A430C463E8C980F9E50F3
                                                                                                                                                                                                                                                      SHA1:02A7345C7AE3849ADFA6A0F1099C0FCC36BAA63E
                                                                                                                                                                                                                                                      SHA-256:D8A570353F1549C4562866EE8B6027523247EAACDFF9D1B93955470B6F40277A
                                                                                                                                                                                                                                                      SHA-512:6455A3EB120D514A029CD4C91422FDA3042B8033869EB30D13269D85D831F0F2E0ABF9A71D8BD84C36AA9D21A4F87F0F95C8C2DED02B2FA1695C5FB078E5009B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........#!..e.....h.....i.....j.....k.....l.)...n.1...o.6...p.C...q.I...r.U...s.f...t.o...v.....w.....y.....z.....|.....}.........................................................................6.....j.........................................n.....`...........I.............................K.....d...........>..... .................Q.....`.....0.............................D...........'.....Q...........}.................=.....~.................A.............................V...........<...........v.....a...........f.............................5.....I...........y...............................................g.............................W.....v.....F.................#...........q.......................................... ..... ....8!.....".....".....".....#.....#.....$....@%....x%.....&.....'...._(.....(.....).....*.....+....Y+.....,....w-.....-....H....../....K0.....0.....1.....3.....4.....5.....5.....7.....8....G9.....9.....;.....;.....<.....<.....=.....>.....?....X?.....@.....A....[B

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-AHQA1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-AQ00O.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):438600
                                                                                                                                                                                                                                                      Entropy (8bit):5.465230664544145
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4CFEEA84F6C770853D931318A2F70809
                                                                                                                                                                                                                                                      SHA1:D63B2641A4971F53878E4B4BAD1790E89CA339DB
                                                                                                                                                                                                                                                      SHA-256:838E50C45EFA4D9AD171B76030F8DEA5A863B7082D212A9471F315C3217650E2
                                                                                                                                                                                                                                                      SHA-512:386EFE5EE41B912C45AB4C06716BD9CE95A3F44E5B2C5E8EBCFF544A1658835358286BD648A090AB093084BC5738579EAA02E5441CAFA156DE42F1B35A894B25
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.&...s.7...t.@...v.U...w.b...y.h...z.w...|.}...}.......................................................................................................3.......................y.................+.......................N.......................N.......................@.......................B.......................R.......................|.................$.......................,.......................F...........;.......................\.....~.................B.....e.....q...........&.....P.....`.................h.....s...........:.....t.................;.....l.....t...........4.....g.....v...........5.....i.....q...........Y.......................Z.....y.................M.....q.................A.....y.................N.......................Q.....k.....|...........@.....h.................L.....................................................N.....s...........O.......................2.....N.....b...........0.....^.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-AVJUU.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-BCMVH.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-BKAS1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-BSR0V.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-CI5QT.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):455012
                                                                                                                                                                                                                                                      Entropy (8bit):5.442077862801261
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F737DC0142DD0A0C1656F7838B6C6C22
                                                                                                                                                                                                                                                      SHA1:6548C88870480EE11440E5857CEECBFC9081077D
                                                                                                                                                                                                                                                      SHA-256:4B5FF741C86044752392F76C2C73EB3A8AA3B4154FAC3061E296CDC8705E20DD
                                                                                                                                                                                                                                                      SHA-512:7CE2C6E2DD858747D719B6A1F11B81F756604106EC0ED5ED3124F430BC8441CEF00ABA578C87A208EBDAB02D36D6408ECD97C53760EAD57F0BF8991FBABF46B8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.+...t.4...v.I...w.V...y.\...z.k...|.q...}.................................................................................................}...........4.....C...........%.....a.....y.............................R.......................R.......................8.......................5.......................]...................................D.....W...........,.....d.....x.............................~...........V.....|.........../.....Y.....k.................6.....D.............................}.................'.......................(.....|.......................`.......................B.......................N...........#.....;......................./.....y.......................T.......................Q.................3.......................&.................#.....8.................#.....9.................[.....i...........z.................F.......................2.............................p.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-CPGA8.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):474164
                                                                                                                                                                                                                                                      Entropy (8bit):5.40021699490739
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D982AF2F9B7AC7A3422AC809979C0060
                                                                                                                                                                                                                                                      SHA1:F40E420CB9F97C335E788C49C0EF6428E08B68DD
                                                                                                                                                                                                                                                      SHA-256:D850E85C14B08823584862CDD810315455C1D23F7E51956A0401611751AA18AD
                                                                                                                                                                                                                                                      SHA-512:64183795EC2EAEB1B565774B5B9B8373D4F811837DC6B21D0822EA4771CAED7C5152C70EFE2AC297C15F7F6904DA0E65B0B1C16D00B252CD42DA5E1F384631ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........&!}.e.....h.....i.....j.....k.....l.&...n.....o.3...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....|.....}............................................................................... .....5.....G...........[.................9...................................h.................n.................%.....y.......................Z.........................................m...........%.....E.................^.....k...........&.....j.....z...........L.................(.......................x.......................c.......................[.......................k.......................s.......................^.......................7.............................{.................1.......................[.......................3.....s.......................b.................".......................Q.......................2.......................=.......................|...........W.....o..........._.................D.......................S.......................F.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-CPKU7.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):570594
                                                                                                                                                                                                                                                      Entropy (8bit):5.8683105344602735
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E4BF58BE4153C80E81D7C4358FE22071
                                                                                                                                                                                                                                                      SHA1:29112BC928529CA6D3E2919E7206692AE850E15C
                                                                                                                                                                                                                                                      SHA-256:B65ACBA77B82785B508031E0AF9E06D6B68D7641D0D3B8D013B5B8E2E52633FD
                                                                                                                                                                                                                                                      SHA-512:B7BE4CF90F03744F78DC3FF7E2729D1A65A5150445170A652FDD2E8375D716F2013C2D821A181EF2A97279C8AF41BD4C6FE04DFE984BC42872EB49CAD28504B4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........o 4.e.|...h.....i.....j.....k.....l.....m.....o.....p.....q.....v.....w.....y.....z.....|.....}.%.....-.....2.....:.....E.....M.....\.....a.....i.....p.....w.....~...............................................$.....v...................................z...........].....x.....>...........Z.................u.........................................R.............................*.....q.................r.................".......................@.............................>.................%.......................E............................./.....v...........>...........*.....N...........S.................-.......................t...........&.....5...........@.................B...........2.....Q...........K.................$.......................d.................=...........I.................4.......................L...................................).....?.........................................i...........%...................................,.....H...........V.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-CTO0R.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):437481
                                                                                                                                                                                                                                                      Entropy (8bit):5.425985328231196
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:94DF2E13FAFA74C40A31212D6961D9B4
                                                                                                                                                                                                                                                      SHA1:A15B17925D9B08B5AD1E17834BC3AEB14C25E22A
                                                                                                                                                                                                                                                      SHA-256:CDB143239D7665CD2BBAA09356DF53ECBFAEDF8F7461996F67743A117D805EB3
                                                                                                                                                                                                                                                      SHA-512:A5CA256AB103243E197E3B1091EDFA87D51E9687F80BFA037B30AC876618787695915D8E4CDB8B05EE441AC828FF54182C270A8E22E1E45ED00FCD834164C082
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}...............................................................................................................................j.................B.................0.................'.....>.......................,...............................................5.................W.....z.............................a...................................b.....|.............................[.......................$.....|......................._.......................[.......................g.......................m.......................b.......................Y.........................................5.............................q.......................V.....x.................w.................H.......................N.......................c.......................q.................+...........:.......................u.......................P.....m.....{...........E.....t.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-D7OBN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):482831
                                                                                                                                                                                                                                                      Entropy (8bit):5.48369452183905
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:55C9BC2AC28DD6DF70702AB4288519BB
                                                                                                                                                                                                                                                      SHA1:C636B766B3427685F951F9605A84D66D8593FDBD
                                                                                                                                                                                                                                                      SHA-256:CEE8EEBC1117E65A69E5C2AE7A72EB52D3F5F8A863CBE41638310D7063B23279
                                                                                                                                                                                                                                                      SHA-512:140C099649DDFD2C182157E8CED83B06C125706C028E77C7FCDFE732CE4080745A2ECCBDB9A5BB4C3942BF07AE5DD978D38937463C7ED7D7AB9D02CF4F9DA4AB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.+...w.8...y.>...z.M...|.S...}.e.....m.....r.....z.............................................................................x...........Z.....s...........I.....z...................................k.......................p.......................b.......................t.................6...........#....._.................^.........................................N.............................1.......................^.....u.................?.....b.....r.................W.....j...........M.......................d.........................................C.......................D.......................S.......................w......................._.......................V.......................}.................P................. .....6.................=.....Q...........".....a.....y.................5.....N...............................................,.....~.......................p.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-DLGUS.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-DN8HN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):678351
                                                                                                                                                                                                                                                      Entropy (8bit):5.076897942157497
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:EB50FC3F8C25754A1A19C16B77CD9D71
                                                                                                                                                                                                                                                      SHA1:92045342072EC1E0E252D15FA76E3BE0D84DF464
                                                                                                                                                                                                                                                      SHA-256:95AFAF5BEF7B1AFCD7427E01E6C13E5F6F1674D219E3A587943FA8C64C9103F8
                                                                                                                                                                                                                                                      SHA-512:118575B4FB2E735E660C11FDA9AD855F56D5480E06C06C78D112D5690ED1776FE6990B87FF8BD7B934F8461A03A4829BC39B08928293B118F1E0DC81C065DAB8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}.....................................................................................!.....@.............................f.............................Z.......................t.............................M.....`...........Y.................W...........(.....X.....;...........M.........................................M.................r...........c...........].......................K.......................k.................&.................3.....F.......................0...........`.................c...........B.....X...........p.................]...........'.....7.......................9...........,.....f...................................z...........4.....M.......................6.................Q.....s...................................2.......................Q.......................j.........................................q.............................a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-DRROJ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-DRUUN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1014023
                                                                                                                                                                                                                                                      Entropy (8bit):4.4638980035455464
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:13E9EC33038D954611274C6CF34AC017
                                                                                                                                                                                                                                                      SHA1:915D31F27F7F9080732DFFB38D99D9DECA2665C2
                                                                                                                                                                                                                                                      SHA-256:7BF84B5A8DCC3E72F28257D1FD6FE1F3105E82631599D6046B5BBE45A5D8D7A9
                                                                                                                                                                                                                                                      SHA-512:844D52768437E639213390F5D15FA5CCE0E1789C69AE49CB722CD0BED9E10667F308EBA0233F98F92E76CFCE342B7395CF53390DD8F62AA42A24409180241A0F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.3...i.D...j.P...k._...l.j...n.r...o.w...p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...............................$.....+.....2.....9.....:.....;.....=....._...........................................................t.............................E.....8.............................C...............................................8.............................E...........k.....-.......................d...............................................................................................o.............................Z.....s.....J...........o..........._...........q...........@...........@.....\...................................................................................0.....}...........D.............................{...........+.................N...........\...........+.....j.....^.....:.............................O.................. .....!....8!....F".....#.....#.....#.....%.....%.....&.....&.....'.....(.....)....G)....D*.....+.....+

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-DRVJR.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513870
                                                                                                                                                                                                                                                      Entropy (8bit):5.378965610026006
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4B9AF14389C7331028D6785CD81DF730
                                                                                                                                                                                                                                                      SHA1:8DE60A81818B41542F74924F837CD4961DBCBFA0
                                                                                                                                                                                                                                                      SHA-256:0C87E104EE1977CF2D7A33A8C95A37C3BB91D558A3C63DACB759E4AD78B580DB
                                                                                                                                                                                                                                                      SHA-512:07EAFF515A138B08AD4CFA1017ECE90A0E5B7C2A4C13451E1A13DA449393793E8158B048E9DF7A77EE34A67C0765F613E3D9809182F0370D72EADA790D175F40
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...|.I...}.[.....c.....h.....p.....x.......................................................................}.....$.................1...................................s.................j.................<.......................A...................................3.....a...........L.........................................I...................................7.....P...........t.................R.......................S.......................M.......................e.......................~.................-.............................n.......................g...................................v.................S.......................7.....W.....u...........>.....{.........../.................%.....~.......................~...........(.....D...........0.....}...............................................:.....a...........l.................-.......................@.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-E5EP6.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-E74V5.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-EEP5O.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-ELU01.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):488236
                                                                                                                                                                                                                                                      Entropy (8bit):5.455703860989617
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:DADDAA3E835A9373E66EB86A5409E960
                                                                                                                                                                                                                                                      SHA1:1358FB2EF112C5EB7E70A0C99EADD12376C70A2D
                                                                                                                                                                                                                                                      SHA-256:065B6F20EF8B354F61BD9FC244385E7650BDF43820CBB96A83A47658E6D864DB
                                                                                                                                                                                                                                                      SHA-512:3D4377966DDE1473227A4DAE3A22D4899DD819E1B3F02920C62BD3389F2C22DF0166962813FADF2AEE1F12C66691C295ACEE4C9D075269B6BD0387515BBC6F43
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.!...t.*...v.?...w.L...y.R...z.a...|.g...}.y...........................................................................................................b.....|...........=.....v...............................................-.....L................."...............................................+.....\...........J.................'.......................Y.......................p.................,...........<.......................^.....|................./.....T.....h.................-.....=.................(.....=.......................4.............................b.......................A.......................\...........$.....>.............................`......................._.......................z...........%.....e.......................-.................D....._...........#.....c.....x...........u.................j.................@.................O.....g.................).....?...........%.....|.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-G4RG3.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-H2PAC.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-IFTBP.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):499035
                                                                                                                                                                                                                                                      Entropy (8bit):5.793845772544824
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:10E36351C04D2014479A78CF2CE9719E
                                                                                                                                                                                                                                                      SHA1:DF29E7C8FAD25D2A6A30870E1CD8D0A799BCEF51
                                                                                                                                                                                                                                                      SHA-256:AA6FB1BEB03C1A5B08D61DC45C985E5B15498D775BB93A204B1A49D63A2E95B7
                                                                                                                                                                                                                                                      SHA-512:0715B0D3A189948BD7DCB899F3ECAD56A626A23E3D24541A0B22A6E6397623820C88D5B41598B1C3B6FEA57183386DB9558893C03646FB4A8267C456DF4308FE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.......................................................................................................^.................b.............................1.......................k.................%.......................+.......................A...................................\.................v.................<...................................:.....Q...........v.................D.......................).......................".......................$.......................^.......................s...................................2.....E.................Q.....d...........~.................3.............................e.......................`.................8.......................z.......................~...................................K.....e.........................................C.....d...........5.....d.....x...........'.....I.....]...........T.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-IKVDT.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-K2G7D.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-KKRIJ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-L92B1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):548715
                                                                                                                                                                                                                                                      Entropy (8bit):5.8169786739645835
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:360E4F740ED214A6B964E62FD57ACC84
                                                                                                                                                                                                                                                      SHA1:D543772D1ADD0822513FA8EDD48F211D4AF16982
                                                                                                                                                                                                                                                      SHA-256:F6030F21C88AF7769CA19AB0F4E518388FBFAD1376B409124F124A60DC045A48
                                                                                                                                                                                                                                                      SHA-512:0E555AC51C73AD57789350920BA160E88D39C6D83FEF45598E22AAA6856B2BE301D0E6BBFEEC55F962D50E6E462EB2A92BACBDBF972E31C162A004D78A279962
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.4...h.9...i.S...j._...k.n...l.y...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...................#.....+.....3.....:.....A.....H.....I.....J.....L.....].....n.................n.......................8.................$...........a.................v...........C.....\.................+.....7.................E.....X...........w.......................W.............................].....o...........n.................v...........[...........:...........7.....c...........5.....^.....}...........].......................x.................G................."................./.....@.................>.....M.................I.....W...........<.....z...........8...........>.....\...........J.......................z...........%...............................................`................. .................X.....{...........u.......................9.........................................;.......................].............................>.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-LF2AQ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):682352
                                                                                                                                                                                                                                                      Entropy (8bit):5.204779136758079
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2A426E8D45A0A93E89F696D8273CEFA3
                                                                                                                                                                                                                                                      SHA1:7B0AEE5D20229528A2FF084D1AFBB72EC18ED007
                                                                                                                                                                                                                                                      SHA-256:397D75FDE14D602013C79CDF3915B932C27D9BF60C3F141979276A0E7CCA3D72
                                                                                                                                                                                                                                                      SHA-512:192027A1D34580212A610C3693983259CA47FB690A59A01B75914748C536B24F6036D65D8EF03E328E731614B3CE599C01EF183FDBC1139F5BF4AF26E209ECC5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.(...h.-...i.8...j.D...k.S...l.^...n.f...o.k...p.x...q.~...r.....s.....t.....v.....w.....y.....z.....|.....}...........................................&.....-...../.....4.....N.....j.......................q.......................v...........................................................*...........t.................f...........L.....m...................................x.......................%.....n...........'.................3.......................4.................S.....w.............................U.................*...........J.................:...........*.....?...........i.................G................. ...........<.....{...........).............................r.................u...........'.....J...................................8.................g...........X.........................................5.................O...........-.....N.....L.....D.......................w.......................b.................\.................%...........p.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-LHI7N.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-LPTFJ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):771792
                                                                                                                                                                                                                                                      Entropy (8bit):4.998193065460115
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:619A163F3F001CCC7AEC2D8EA7896F45
                                                                                                                                                                                                                                                      SHA1:B671D6F771EF0A83A676A6B03232218A379DF3FB
                                                                                                                                                                                                                                                      SHA-256:8C9FA3C306711C0847A9C81BEBD835C6F31DEF21FEE215671931E90652683C51
                                                                                                                                                                                                                                                      SHA-512:F037247E08B9EDCDAF9B8BFB2180B1D8E499FD3289616A0DC0B7C1F23164A8049C90382F767B9362396A2D1D697A016D2D87CD93A1F27141D008AEAC88796D64
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........} &.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~....................................................................... .................&.....E.........................................6.....d...........r.......................N.................+.....}.......................#.....~.................p...........1...........}.......................<.................i.....7............................._...........0...................................0.....O...........<.....m...............................................m...................................o.................:.................X.....q...........N.............................*.....N.................F.....a...........|...................................g...........N.....v...........;.................2...........o...................................4.....?...................................E.....d...........].......................:.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-M5UHG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513305
                                                                                                                                                                                                                                                      Entropy (8bit):5.634113941216602
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A803BD5E36C7A73F2338A3598C8545A2
                                                                                                                                                                                                                                                      SHA1:A9FB29A9A1116C19FAAE19E4A87E27D833B49F3B
                                                                                                                                                                                                                                                      SHA-256:F5D761B47C8AB719E59E24EB51C5E22762D95F8F96BCDBDFC73485CF45D7FB20
                                                                                                                                                                                                                                                      SHA-512:2EB35179B8FE21CFF3EB6C727A6DE3A1EC73CF9F05C3327E1A2A4FF1BF8EE4D9C0527D155E6750FF2FD4FCDE0AD963427055ECD51F40324A65B962597E2CF121
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n. ...o.%...p.2...q.8...r.D...s.U...t.^...v.s...w.....y.....z.....|.....}.....................................................................................'.....C.......................#.................W.....j.........................................\.....{...........Z.........................................R.................#...........h.................K.................1...........).....b.....u...................................-.....}.................i.......................r.........................................8.................'.................=.....O...........=.....t.................l...............................................&.....x.................S.....n...................................8.......................m...........=.....w...........D.....d.....}.............................M.................(.............................}...........8.....^...........Y.......................u.................7.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-MB338.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1132527
                                                                                                                                                                                                                                                      Entropy (8bit):4.208230669652696
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D1BDAB6B9159FE626AD90E254A86E927
                                                                                                                                                                                                                                                      SHA1:979B0AB979522A8A72AE4151284C52F5EFC413BD
                                                                                                                                                                                                                                                      SHA-256:B0D0730F8EAA23BC6CCEB9EAC0194D173CDE81FCD8FA6EF0690DD80B0ED89C84
                                                                                                                                                                                                                                                      SHA-512:356946DE5BDF1EDDC96726C15F7BD83ADD60DF4F05024491B712E9F7F0F192334DE3E924A60D9D5C0488DDC683261ACCF606333CBAFB3B773FA28A2DC86131C8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.x...h.}...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y."...z.1...|.7...}.I.....Q.....V.....^.....f.....n.....u.....|.........................................&.......................H.....q.............................u.......................<.....r...........@.....A.....4...................................'....._.....c...........N.......................*.....K.....a...........G.................S.................-...........\.......................e.....h.....1...................................4.................R.......................M.............................4.....".........................................C.....=.......................6...........c............ .....!.....!....;".....#.....#....B$.....$....h%....Q&.....'....i'.....(.....)....#*.....*.....+....F,.....,.....,.........../...../...../....x1.....2....l3.....3.....5.....7.....9....?9.....:.....;....]<.....<....=>....c?.....@....t@....xA....eB.....B....%C....WD.....E....$F

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-MMO7E.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-MQEMN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):678309
                                                                                                                                                                                                                                                      Entropy (8bit):5.314848091341466
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F2080E238404C45ADA98CA531E88A22B
                                                                                                                                                                                                                                                      SHA1:5375213D91649189EA01F2C0C1E055A899F8407A
                                                                                                                                                                                                                                                      SHA-256:D4AB2D065B60D4BDFAC5C45A38DD889CE1D0E9D769207DD4D8EA65A7C13818D3
                                                                                                                                                                                                                                                      SHA-512:CA657C89EE754A51ECDE7313EC5FD1ED8118C35885FAAF8B1A6BABDE67D7272A8C13FD1386CD790236FB15A898AD0D489FC2DAD2CB7497C2AA2AC9CD043FC306
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|...................................................................................*.................H.....o.....+...........;....._.....>...........z...........b...........i...............................................g.........................................i.......................C.................d...........`.....}.....P.............................[.............................9.....a...........L.................%...................................`.....~.........................................f.................~.................i...........7.....S.................@.....k...........{.................q.................-...........4.....z...........b...........^...........,.............................3.................}...........w...........x.....,.......................d........... ...................................%.....j...........<...........#.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-NHDGV.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):514501
                                                                                                                                                                                                                                                      Entropy (8bit):5.639969437567393
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5B2A9EF5398E6E2F0FDA674BCB1F1493
                                                                                                                                                                                                                                                      SHA1:9254CE803625B66690B106D24232DE80C46DD9AC
                                                                                                                                                                                                                                                      SHA-256:11EBCD04B8DA2D95CAB4DAF863F3149C16DF088D8BB463D9BF8B04814FE53D05
                                                                                                                                                                                                                                                      SHA-512:7E08D1B7634C019699C5DFC9A61E8790655BE4AF1695E1C2C4E487C2B6A9C2BBE8EDBF51EC5256A77890AC97D87A181CDDDCF528C02EA418ABE2FBAB44AE84BC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.x...h.}...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y. ...z./...|.5...}.G.....O.....T.....\.....d.....l.....s.....z...........................................................5.................9...................................}...................................K.......................Y................. ........... .....^...........*.................3.................Y.....k...........R.................*.............................*.........................................C.......................Z.............................8.....~...................................o...........G.....\...........I.........................................t...........Y.....o...........S.....z.................a.......................}.................e........... .....W.................0.....H.................8.....N...........A.................@...........V.....e.........................................k.................U.................(.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-NLEJI.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-NO5ER.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):771174
                                                                                                                                                                                                                                                      Entropy (8bit):5.034185565907101
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:18B1A3E297FEED3729177908E9BFDEBE
                                                                                                                                                                                                                                                      SHA1:5380FAD32AF5DE6E502D80FD9AD069422AA26DC4
                                                                                                                                                                                                                                                      SHA-256:DDC042E753E223B5D2003CBA9E8A8A212BF33D7DF247DCFA05AEBAE1597856C0
                                                                                                                                                                                                                                                      SHA-512:64D58531230AA21A57D3E8B5E5B8048D4A04BD0EB7053C52FBA7CE255FBD04F02B29DE36636C761499E2B1186163B16C35CBEF237732A835A10C1B36218E83EA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.B...h.G...i.X...j.d...k.s...l.~...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}............. .....(.....0.....8.....?.....F.....M.....N.....O.....T.....q...................................$.....C...............................................L.....'.................n...................................C.................l...........X...........~.....?.......................J.................v...........j...........Q...........i.................J.............................5.....h...........q.................Y.............................}.......................%.....u...............................................Y.....x.........................................K...................................o.............................t.............................)...........1.............................).....m...........q...........w.................i.........../.................Z...........K...........1.....T...........[.......................9.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-NP3P0.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-O57L9.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):938947
                                                                                                                                                                                                                                                      Entropy (8bit):4.476005642636115
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E1DEF501525512978C2B6372F979002
                                                                                                                                                                                                                                                      SHA1:FCE5F22860456D8336C9ED0E33770AA2C843C3CF
                                                                                                                                                                                                                                                      SHA-256:1DFF66D6D91A081D3E6866EC2917F9081CA9E4DD46CF0A94C985F9E759C3D6EC
                                                                                                                                                                                                                                                      SHA-512:41B9B838ED8CE819ED4DCECD36D5F9A7C19792CF1ABAFA6EBFF7F3E00504298D869B3AF18BF85092A89817F63D5D19C097A5F8263B7BA035DF8B792B76E09981
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.R...h.W...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................t...........j...................................5.....b.....8.............................E.................3.....u.....A...........u.................}...........7.............................6.....9.........................................&.....D...........-...............................................V.......................:.........................................?.....w....._.....5.......................X.......................X.......................k.................5.....^..... ....._.......................@...................................o.................7.....2...........H ....2!.....!....P".....".....#.....$....N%.....%.....&.....'....Q(.....(.....)....4+.....,....D,.....-..........B/...../.....0.....1.....2....@2.....3.....3....:4....c4.....5....x6.....7

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-OHH1T.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):498162
                                                                                                                                                                                                                                                      Entropy (8bit):5.741520130097087
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4EA1D17290B7E3D412C50C991428AAD7
                                                                                                                                                                                                                                                      SHA1:CF9CCED4F53A185AB399BEEB9216231B5A8FBA07
                                                                                                                                                                                                                                                      SHA-256:1638385F5841E57796BEFF0B247307DD72E95784131BBDD91E408E6888510490
                                                                                                                                                                                                                                                      SHA-512:89FA088334F9AA7C1160330C886151C333C15E4F8A3B7C2FA320FC5AF91CD2404D7966284D1F82F876F0DB67730839ADC314520E7535735B89C9773424193593
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.E...t.N...v.c...w.p...y.v...z.....|.....}..........................................................................................."...........S.................A...................................O.....m...........0.....q.................<.....h.....|...........G.....{.................d.................@.................).................+.....D.................>.....Q...........N.................E.................=.............................b.......................*.....t.......................l.......................t.......................n.......................Z.......................R.........................................4.............................].....~.................S.................".....{.................N.............................|.................F.......................}...........A.....W...........M.......................u.......................D.....b.....q...........G.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-OP123.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):447382
                                                                                                                                                                                                                                                      Entropy (8bit):5.28224913603811
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3B2E87D63A91A833C677F965C04297D6
                                                                                                                                                                                                                                                      SHA1:9AD268F1EB2AF1C453FE22CCBD54743FE6CE6B04
                                                                                                                                                                                                                                                      SHA-256:7F092467CE9E3146E3F060ECB0CF3DD19E1995C39597368CF6CD9DC78A3F864E
                                                                                                                                                                                                                                                      SHA-512:DC1B936F9B2F8A8F2FF90963B4D28DAF850991A035F92B90BDD1D962176A22D01F5B624A04F5F3E28BDD3D20A65D4EAB6758BDAC5254C8533353828B150F0530
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................$.....;...........B.......................s.................*.......................\.......................v.......................l.......................n...................................M.....e.................2.....;...............................................&.................j.....|.................(.....:.............................X.......................>.......................K.......................D.......................4.......................$.......................2.......................U.......................=.............................d.......................M.......................-.....E.....Q.................C.....R.................`.....y...........p.................B.......................Z.......................6.....~.......................^.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-PDC0K.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):478165
                                                                                                                                                                                                                                                      Entropy (8bit):5.349796633731915
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:07BB68F58F393361DA76BE2834C07D5E
                                                                                                                                                                                                                                                      SHA1:F6358616A346C0266F00067D95BEB356A2985BFA
                                                                                                                                                                                                                                                      SHA-256:C0913E46AC7CA5D0A5E2B50E006376FD355083A5E6903AB4624539CFD0CC7931
                                                                                                                                                                                                                                                      SHA-512:14ABCA4E424FFFA33197FD4CF23EE3DBA655744FA572729804590444DC980ED52053EE06328DE1164E10943EEBC74A24A182DA8CA31EC7A612378540BC178AE8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.......................................................................................................B.................,...................................}.................z.................).......................'.......................N.................2...........,.....m.................c.................".......................W.................,...........:.......................b.......................W.......................Q.......................i.......................d.......................Q.......................6.....e.....o...........-.....\.....l...........Z.......................q.......................k.................+.......................X.................H.......................2.................".....5.................U.....o.........................................Q.....z...........].......................W.....}.................a.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-PE7SP.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):490657
                                                                                                                                                                                                                                                      Entropy (8bit):5.381493625399228
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C8D71F3E86934D84781196D2DC57BC4D
                                                                                                                                                                                                                                                      SHA1:6F13F909A551D3553800C9F164AC53D4E8E19191
                                                                                                                                                                                                                                                      SHA-256:F946C994D185F25F22AB113EFD6C6D9C4CF42FCB1DA056658F40840C28AC76AE
                                                                                                                                                                                                                                                      SHA-512:421CDACD2FDDAD59D5405BBB76AB09195600B1DD69E49C0923CD99E7C865D3F1E224E4EF2864F6B40E2DDB2C39404D64DFE1E8D06F457C26F05EC78AAA7ECC48
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.4...w.A...y.G...z.V...|.\...}.n.....v.....{.........................................................................................V.................P.............................+.......................m.......................q.......................h.................1...................................A.....g...........9.....{.................I.......................r.................n...........R.....x...........,.....Y.....u.................5.....E.................!.....8.................=.....R.................:.....N.......................).....x.......................[.......................{...........1.....M.................1.....P.......................s...................................<.....w.................;.....T.................0.....E.................S.....o.........................................M.....w...........F.....y.................2.....Z.....m...........E.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-PHFQA.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-Q0AS1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-Q7D9G.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-QCS2M.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):974435
                                                                                                                                                                                                                                                      Entropy (8bit):4.454267523838959
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F8CFC4DBB18026B4D8D7C8E54996CE49
                                                                                                                                                                                                                                                      SHA1:B8456FBF874A86F265A938BC062E851FFCCD8698
                                                                                                                                                                                                                                                      SHA-256:34BDEF7BE00711A45E3ACAA986A620B3E2C7FEB5149ED2E86BC4482F3E56294A
                                                                                                                                                                                                                                                      SHA-512:05843850E487005DD705774BFC39E4F130D41A315BFB30F227AB82427A315A7F23C8E39589E1099F52D57DABE3E06A2B25FAB5FEE731EFA9E4F206F53911562E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.+...y.1...z.@...|.F...}.X.....`.....e.....m.....u.....z.................................................................P.....z...........@.....|.....q.....H...........!.....F.....@...........=.....5.......................{.....>.......................>.............................H.................k...........Q.....@.............................B.............................T.......................H...........e...........C.....v...................................?.....r...........u.....$.........................................j...........^...........,.................;.............................&.....B...........U.....O.......................x...........C.....s.....A...........n.................[...........j.....$.................6.................$.....\....._....................... ....t!....g".....".....#.....$....x%.....%.....&....|'.....'....'(.....(.....).....*....]*....c+....7,

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-QGIV3.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-QH1K4.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):960557
                                                                                                                                                                                                                                                      Entropy (8bit):4.489329939358189
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:66EC4FD80F9F253BC30B090331995465
                                                                                                                                                                                                                                                      SHA1:A94482524B1E17688086D71B8605F7568DD25BC4
                                                                                                                                                                                                                                                      SHA-256:56008F3DCCE5762ECD33D20E59204D5F770E37C84681965D1BE5F8E9BA6358C1
                                                                                                                                                                                                                                                      SHA-512:CE063A7FB21AF761291A7F533E144C3AA95A5EB3DB1B83466BB812520781DD0249183F54640C0577C6322D4F0DF6D42323CABADFA11A48230D9EC0928B107E7D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.0...w.=...y.C...z.R...|.X...}.j.....r.....w.............................................................................U................._.................O.................;.........................................A...........v.......................2.......................J...............................................q.............................:.....f.....c.....^........... .....C.....Q...........9...........c.......................=.....t...........D...........4.....M.................2.....].................4.....V...................................r.......................H.........................................z.....,.................0...................................%.....K.....V.....!.......................h.....................................................b.................................... .....!....k".....".....#....w$.....$.....%.....%.....&.....'....)'....H(....%).....)

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-QR07R.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):743531
                                                                                                                                                                                                                                                      Entropy (8bit):5.0623318835033055
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:83CECA202112AB6C1524DB354AD6A25F
                                                                                                                                                                                                                                                      SHA1:923357FB6B0E9BA9746A0A17C18D7C91D3906E17
                                                                                                                                                                                                                                                      SHA-256:66681B0DB2A0CFCF8499613B613F49CB8A54373B1E895EFDE1FECB3C6C9F96B1
                                                                                                                                                                                                                                                      SHA-512:F23B8F1F404E56FFB48B8B66060DC46CB59B62BF58C21889F641595F1ADD808BF9D4C3B8FD89C46919F9EF4C29AF6B616EFFDC300B0A1A5149E7F09E96A5BCD5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.d...h.i...i.t...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}./.....7.....<.....D.....L.....T.....[.....b.....i.....k.....p.....................................................S...........J.....l.................;.....W.......................K...........f.................9............................./.......................*.......................j.......................O.................q.....:.............................[...........>.................'.................C.....X...........b.................r.....(.................6.............................E.................?.............................%.....j.............................3...........2.....j.............................j...........a...........#................./.................*.....G...........j.................`.................2.....:.............................;.................R.................*.......................-...............................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-RQ6I8.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-RT5FD.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1087829
                                                                                                                                                                                                                                                      Entropy (8bit):4.39588397300187
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:AE34B16CD9DCC261EC874CBB8D42B0D8
                                                                                                                                                                                                                                                      SHA1:42C211215D2342727F742970EAC83E8045E2DE3D
                                                                                                                                                                                                                                                      SHA-256:D4B30C5DD0FF6430E5ACD1BE1E1DA2882664DBA6AF2257E93C0E3B8B48F01C08
                                                                                                                                                                                                                                                      SHA-512:24FCFAFDC4BC21316E99D2F6115DB9B3070CE534077F098A4E706E3C7C304955D3A23E5909DC7269A28148D4D13AF5FE4840DAAF8460ADAEE713169EA447411E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.$...r.0...s.A...t.J...v._...w.l...y.r...z.....|.....}...............................................................................H.................S.......................*.....2...........A.........................................F...........B...........9.....m.....Z.....#.............................Z.................*...........b.....h.....<...............................................(...........:.......................)...........[.......................).....|...........>...........'.....<.................`...........n.....(.................z.....+.......................Y...................................).....K.....J...........9.................:...........'.........................................I.....q.....9...........N ....6!.....!....;".....".....#.....$.....%....b%.....&....s'....=(.....(.....*....u+....s,.....,....!....../...../....U0.....1....r2.....3....e3....24.....4....E5.....5.....6.....7....F8

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-RV943.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-S2I63.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-S4PP1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-T73MG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):460837
                                                                                                                                                                                                                                                      Entropy (8bit):5.356256987882625
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4FA48F6B14AE1C0C91E6A6B9698D8030
                                                                                                                                                                                                                                                      SHA1:8394200D1382A1C178B98E8774CB92CD79442D6E
                                                                                                                                                                                                                                                      SHA-256:2081C3DD167D916E7867AA4DA856648E0962659B1081436F2BC802E772C443A2
                                                                                                                                                                                                                                                      SHA-512:9F8419DF7B40ABAE05471B54835764E032EC66533CB33AD57FBFAEE33B2931192D48343E97427441E0DFC7AB5327469A98B3F896666E7F421730B1337FF51EDB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~.............................................................................|...........K.....a...........0.....o.................t.................9.......................+.....~.......................c.......................m.................O.................3.................?.....O.................5.....C.................D.....X...........g.................:.............................X.....{.......................D.....P...........3.....~.................=.....q.................G.......................7.....f.....s...........-.....f.....o...........S.......................e.......................o.................1.......................M.................$.............................Z.......................h.................*...........$.....|.................r.................[.................%.......................3.................b.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-TH077.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):429060
                                                                                                                                                                                                                                                      Entropy (8bit):5.382923282966039
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:37551F46F9D37B93562375FB0A9FB258
                                                                                                                                                                                                                                                      SHA1:A8492C2D30C50CF453D54AA5B133326A8C481A19
                                                                                                                                                                                                                                                      SHA-256:D6E3A3EC7DA8E6C32D010DD00D39AB26E2A4C652C3AA40F7DF3D623C38E5478E
                                                                                                                                                                                                                                                      SHA-512:BBAFF7029365ADD25F9737DECA09A2C544499D0C11C8023FF572A1F7C106F597214B3BF8B013A27C99E1EDC2F6D4DEA9492EA957D5315F3CF819467AE7D15FC0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.!...w.....y.4...z.C...|.I...}.[.....c.....h.....p.....x.......................................................................Q.......................q.......................b.......................~.................$............................._.......................I.......................Q.......................E.............................p.......................p.................2.......................9.....v.......................5.....Z.....f.................(.....2....................... .....t.......................O.......................'.....v.......................].......................P.............................9.....J.............................s.......................T.......................8.....t.......................N.....|.................G.........................................j.......................}.......................S.......................).............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-TKRTJ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-TOE90.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):477955
                                                                                                                                                                                                                                                      Entropy (8bit):5.515444008768555
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:926310EEC6F3B1AEEB9901BD8DB5FA5D
                                                                                                                                                                                                                                                      SHA1:42A3D4FF43741BE567CD0F713CD0023D48F7CF68
                                                                                                                                                                                                                                                      SHA-256:A3F68D44DA13E7A2BBFCC60F80D43EBF6CD3CC1877345F882CB1A9B086F3B732
                                                                                                                                                                                                                                                      SHA-512:478FE4A6A27F91A3B904D6DF95D61DDDA47BAC0BC60F9A809E2463E3E8395EF9FF764A13F4EA7D4A74E86F893187220752FBF75CF4E644B2DE50EAFE97926344
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.#...p.0...q.6...r.B...s.S...t.\...v.q...w.~...y.....z.....|.....}........................................................................................... ...........L.................9.......................l...........,.....K.................[.....q...........+.....].....m.................;.....K.................P.....u...........r.................M.......................t...................................U.....p.............................n.......................L.............................^.......................R.......................M.....{.................U.......................J.....u.................0.....].....m...........].......................c.......................I.....h.................1.....^.....u...........T.................'.....v.................".....~.................P.............................%.....}.................w.................B.......................0.....y...............................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-TUKAT.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-U68HN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):397719
                                                                                                                                                                                                                                                      Entropy (8bit):5.491741053176572
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:85CE8484B4F6D435AECA02833072A516
                                                                                                                                                                                                                                                      SHA1:82D4E7A528622BBCB8A11BEABBBFA45CAA7BC1C3
                                                                                                                                                                                                                                                      SHA-256:DA1DF4B23F91E67D134FA1388267244675604722DB427513178E1A2D3D0E2E78
                                                                                                                                                                                                                                                      SHA-512:F32A05527BBB9BBADDC6A9F14F8E28022FC7BA058177B86030FE06416298EAC47625782A44AB5F00EC22F242A234CFBC34D758F2397CD2837F6727B4F0E01FC7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........E!^.e.(...h.-...i.;...j.G...k.V...l.a...n.i...o.n...p.{...q.....r.....s.....t.....v.....w.....y.....z.....|.....}.....................................".....).....0.....1.....2.....7.....D.....S.....c.....t...........G.......................E.....v.................F.......................=.....l.......................<.....J.............................\.......................?.......................5.............................X.......................'.....S.....^...........'.....i.....}.............................[.............................>....._.....k.................E.....X.......................(.....q.......................2.....v.......................7.....`.....k...........$.....a.....v.................&.....<.............................D.............................Z.......................1.....L.....[.................3.....C................. .....8.................S.....a...........!.....X.....u.................C.....R.............................h.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-UE191.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-UI8GM.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):722396
                                                                                                                                                                                                                                                      Entropy (8bit):4.94233616273736
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:764FC3698AC18A50623D46DA933831BD
                                                                                                                                                                                                                                                      SHA1:82F060252E58CBD1C51A37CF4C227E7506A2DE8A
                                                                                                                                                                                                                                                      SHA-256:679743F42FE47CC21AE4770941080D9730A8CB868331EB8E6DFB71ABA523604E
                                                                                                                                                                                                                                                      SHA-512:78909E20FB89FAD51D99152AEDCC3DC09BBFA5C187068ED9FEBEA6021182B4D366A8FF46F10076D67822285340269031EABD78D4A4C2167B0AEA9A2A63813022
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}...............................................................................,.....Q...........s.....0.......................M.............................6.....j.....A...........[...........7.................1...........4.....{...........d...........S.................L.......................t.......................T.......................x...........+.....7.......................}...........$.....F...........K.................4.............................].............................e...............................................d...........+.................%.......................F...........L.................K.................'...........m.......................6.............................2....._.....!................./.......................@.....-.............................H.......................G.................E.....................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-UJ3OA.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):771584
                                                                                                                                                                                                                                                      Entropy (8bit):4.835506405369879
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:983FA172C059DFD7708957582CB4B880
                                                                                                                                                                                                                                                      SHA1:E68C5A19FC3A6AFD6173285CC2734DB7EFD185BF
                                                                                                                                                                                                                                                      SHA-256:F916D26768743DE45B7090D9024FEB557335AC77501F0DB319DFDE75AC7F8C2C
                                                                                                                                                                                                                                                      SHA-512:36C26A89A627E4507D27A406DFABB7227BBEC5CD4A94A177A2E828CA4E5F9C175F1F5ADAB6061E27FEC4C63A9833BAB8E1A67A8E4F5DF23B18F326AFC978C169
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.*...t.3...v.H...w.U...y.[...z.j...|.p...}...........................................................................................@.....M.....'.......................x................./...................................6...........!.............................6.......................K.............................S.................J.......................y.............................<.....v...........b...........E...........r.............................b...........).............................l.............................i...............................................P.....v.......................!.........................................T.....................................................8.....1...........]...........y...........>.....n.....8...........3.....e.....S...........h.................h...........4.....,...........d...........y...........l...........H............ ....D ....?!....."....."

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-UN0I5.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-V34TJ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):407331
                                                                                                                                                                                                                                                      Entropy (8bit):6.753245960246669
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:21199103AE06024BC6A5D60778971E16
                                                                                                                                                                                                                                                      SHA1:C11690D0EDBD708843DF2BCB8A6964FE5C1E9581
                                                                                                                                                                                                                                                      SHA-256:A37692DA02399597D14DBF99339EBFD247750CA480A8D90BB3D8A69F040D4FBD
                                                                                                                                                                                                                                                      SHA-512:7644315BD7DFC458F10C613FD44A316787F5F838682EE92BE777B2D4C441F8E2DB8977E6884BE8BA8CD7AB041F52371D8B206E7CDAEA00AF43657529B43BCDAB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.7...v.L...w.Y...|._...}.q.....y.........................................................................................{...........A.....S.................6.....B.................C.....U.................V.....k.................9.....E.............................p.......................p.................-.......................*.....}.......................c.......................j.................!.....m.............................w.......................<.....\.....k...........6.....s.................*.....S....._.................?.....K.......................".....u.......................x...........#.....7.............................`.......................R.......................5.......................$.....g.......................F.....o.................C.....x...................................F.......................U.......................%.....l.......................M.....z.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-VD90T.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-VF6SB.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):440166
                                                                                                                                                                                                                                                      Entropy (8bit):5.527600996955519
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A87B6D35CFE2F86AA731AB9935089E3B
                                                                                                                                                                                                                                                      SHA1:BA78688E14D7D6631047858E069C55E326AE2FE2
                                                                                                                                                                                                                                                      SHA-256:4BFCAF23F9BF5DABB9CB05A868654F0FE2CE9D36C1C8C05849F8122F0DDF1235
                                                                                                                                                                                                                                                      SHA-512:5FC0736CA6BBA0F003CAD4D043038DB57D21362C055A4587DC9B2644B25A02194565F82AD151D7DC18F4C3C4A90C5D015C17C3B31692C774F5999802DA5A37ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.\...h.a...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....k.....|.......................9...................................+.....<...........;.......................t...............................................~.................7.......................u...........-.....M.................6.....E...........#.....a.....q...........m.................i...........W.....v.................8.....K.......................-.............................t.................&.............................v.......................f.......................].......................h.................%.....}.......................V.......................(.....w................. .......................M.......................<.......................:.......................U...........7.....K...........7.....r.................d.......................A....._.....m...........+.....Z.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\is-VKIDK.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\it.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):478637
                                                                                                                                                                                                                                                      Entropy (8bit):5.28216096924835
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:34496B477B0AFBCB9671DB428AA7C9BA
                                                                                                                                                                                                                                                      SHA1:24B8989C23E384C0AA2323FA4FB9291FEEBE76B9
                                                                                                                                                                                                                                                      SHA-256:5277EC6DFDBF84D9D15FBC75CC5BE02E9F75E434256D52F3D96C4AE21EFCFF75
                                                                                                                                                                                                                                                      SHA-512:6A744E7E079137811BAD95C9C763DFE91C008F29833C86E1CFAAF3075675B90F48B75E2586A2C91663904141326F0CA512E9B10163F071B4A96C6103D4DB2733
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.$...r.0...s.A...t.J...v._...w.l...y.r...z.....|.....}...........................................................................................#...........;.........................................c...........<.....X...........M.......................Y.......................).....U.....d...........@.....}...........)...................................2.....C.................=.....S...........*.....p...................................X.......................>.............................Q.....x.................M.......................H.....{.................#.....Q.....Z.................%...............................................D.....].................).....B.............................J.......................Y.................6.............................o.......................{...........#.....I...........`.................m...........%.....O...........<.......................+.....M.....`...........-.....k.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\it.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ja.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):570594
                                                                                                                                                                                                                                                      Entropy (8bit):5.8683105344602735
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E4BF58BE4153C80E81D7C4358FE22071
                                                                                                                                                                                                                                                      SHA1:29112BC928529CA6D3E2919E7206692AE850E15C
                                                                                                                                                                                                                                                      SHA-256:B65ACBA77B82785B508031E0AF9E06D6B68D7641D0D3B8D013B5B8E2E52633FD
                                                                                                                                                                                                                                                      SHA-512:B7BE4CF90F03744F78DC3FF7E2729D1A65A5150445170A652FDD2E8375D716F2013C2D821A181EF2A97279C8AF41BD4C6FE04DFE984BC42872EB49CAD28504B4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........o 4.e.|...h.....i.....j.....k.....l.....m.....o.....p.....q.....v.....w.....y.....z.....|.....}.%.....-.....2.....:.....E.....M.....\.....a.....i.....p.....w.....~...............................................$.....v...................................z...........].....x.....>...........Z.................u.........................................R.............................*.....q.................r.................".......................@.............................>.................%.......................E............................./.....v...........>...........*.....N...........S.................-.......................t...........&.....5...........@.................B...........2.....Q...........K.................$.......................d.................=...........I.................4.......................L...................................).....?.........................................i...........%...................................,.....H...........V.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ja.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\kn.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1087829
                                                                                                                                                                                                                                                      Entropy (8bit):4.39588397300187
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:AE34B16CD9DCC261EC874CBB8D42B0D8
                                                                                                                                                                                                                                                      SHA1:42C211215D2342727F742970EAC83E8045E2DE3D
                                                                                                                                                                                                                                                      SHA-256:D4B30C5DD0FF6430E5ACD1BE1E1DA2882664DBA6AF2257E93C0E3B8B48F01C08
                                                                                                                                                                                                                                                      SHA-512:24FCFAFDC4BC21316E99D2F6115DB9B3070CE534077F098A4E706E3C7C304955D3A23E5909DC7269A28148D4D13AF5FE4840DAAF8460ADAEE713169EA447411E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.$...r.0...s.A...t.J...v._...w.l...y.r...z.....|.....}...............................................................................H.................S.......................*.....2...........A.........................................F...........B...........9.....m.....Z.....#.............................Z.................*...........b.....h.....<...............................................(...........:.......................)...........[.......................).....|...........>...........'.....<.................`...........n.....(.................z.....+.......................Y...................................).....K.....J...........9.................:...........'.........................................I.....q.....9...........N ....6!.....!....;".....".....#.....$.....%....b%.....&....s'....=(.....(.....*....u+....s,.....,....!....../...../....U0.....1....r2.....3....e3....24.....4....E5.....5.....6.....7....F8

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\kn.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ko.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):483029
                                                                                                                                                                                                                                                      Entropy (8bit):6.190574567732633
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1A20D15C10E4E71EED2E17BB45682BFE
                                                                                                                                                                                                                                                      SHA1:B4CD02FF581802B91241FDA83F1038CC89C91C34
                                                                                                                                                                                                                                                      SHA-256:4AA01FD54571F1DD0B8CD680FFAE28F22DB69DDC0007644DA5F8589AB8D79930
                                                                                                                                                                                                                                                      SHA-512:F016F32A8DDD109F0F414EF9C7F4C74CDE70389E9D9E2F5534BC4717FFFEE43DA10158FB13D383E6FB567EC671D6AC3057D9992141B141A7228500B2E1E54AEF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........E ^.e.(...h.-...i.>...j.I...k.V...l.^...m.f...o.l...p.s...q.y...r.....s.....t.....y.....z.....|.....}.......................................................%.....'.....,.....8.....H.....[.....k..........._.................6.......................i.................1.................C.....W.................J.....Z.................M.....`...........+.....P.....k...........I.....~.................M.....{.................?.....k.....x...........J.........................................^.......................>.............................g.........................................A.......................L.......................S.......................P.......................n...........).....=.......................&.......................,.......................*.................Z.......................,.....9.................#.....6................. .....;...........9.......................f.......................v.......................k.......................`................. .

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ko.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\lt.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513942
                                                                                                                                                                                                                                                      Entropy (8bit):5.626142284867624
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:70E7E0E790C4B738708230DCD236EFA7
                                                                                                                                                                                                                                                      SHA1:81B7AA5935AB339EF420D7943415A96670FFB1C5
                                                                                                                                                                                                                                                      SHA-256:3962C3C701848B47BF924AD128A8D5BF36A963C947E2CCFA1605B189408B62F2
                                                                                                                                                                                                                                                      SHA-512:5B185022F640B381C51A07806E50451834A909A1475FF4357A71960992E3B574EA89FA20C674810A976578A9F66435A25C2FEFFF8C935AB58E32018CBCBBB3CA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.+...t.4...v.I...w.V...y.\...z.k...|.q...}.......................................................................................................0.................&.............................9.........................................e.................,...........(.....`.....w...........q.................T...........$.....>.................e.....v...........d.................A................."...........G.........................................D.......................o.................0...........*.....f.....y...........m.................3...................................8.....I...........0.....d.....r.........................................).....I...........Z.................9...................................K.....~...........U.....w...........(.............................!.....k.......................*.....B...........K.................G........... .....1.......................&...........:.....{.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\lt.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\lv.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):513305
                                                                                                                                                                                                                                                      Entropy (8bit):5.634113941216602
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A803BD5E36C7A73F2338A3598C8545A2
                                                                                                                                                                                                                                                      SHA1:A9FB29A9A1116C19FAAE19E4A87E27D833B49F3B
                                                                                                                                                                                                                                                      SHA-256:F5D761B47C8AB719E59E24EB51C5E22762D95F8F96BCDBDFC73485CF45D7FB20
                                                                                                                                                                                                                                                      SHA-512:2EB35179B8FE21CFF3EB6C727A6DE3A1EC73CF9F05C3327E1A2A4FF1BF8EE4D9C0527D155E6750FF2FD4FCDE0AD963427055ECD51F40324A65B962597E2CF121
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n. ...o.%...p.2...q.8...r.D...s.U...t.^...v.s...w.....y.....z.....|.....}.....................................................................................'.....C.......................#.................W.....j.........................................\.....{...........Z.........................................R.................#...........h.................K.................1...........).....b.....u...................................-.....}.................i.......................r.........................................8.................'.................=.....O...........=.....t.................l...............................................&.....x.................S.....n...................................8.......................m...........=.....w...........D.....d.....}.............................M.................(.............................}...........8.....^...........Y.......................u.................7.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\lv.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ml.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1136176
                                                                                                                                                                                                                                                      Entropy (8bit):4.421789550677631
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E3DEA39A4A8CFE525CEEF90EAA6F0D84
                                                                                                                                                                                                                                                      SHA1:9CE3048C9B0443D255F2877667356FEFC59901A5
                                                                                                                                                                                                                                                      SHA-256:404713A5F7C244AA7D35C92BD10B54C7D6A6523F64966849DDAD362355B56671
                                                                                                                                                                                                                                                      SHA-512:E89DD594AE0CA30984186F03CC9A055F856A0E3AE27906A1EF091111342AC70D008DF71E957466F29EC5D2CBBC13052C16FC739118B5C185A5BB819DFF2A1A07
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q. ...r.,...s.=...t.F...v.[...w.h...y.n...z.}...|.....}...............................................................................S.................E...........r...................................T.................................................................M.....>...................................).....x.................................................................d.....................................................#...............................................A.................%.....Y.....;.............................:...................................H.....4.............................Z.......................0...........4.................P...........M...........A..........._....., ..... .....!....3".....#.....#....9$.....%.....%....E&.....&.....'.....(....?).....).....*.....+....:,.....,.....-.........../...../.....1.....2.....2.....3....\4....W5.....5....J6....;7.....8.....8.....8.....:....+;.....<

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ml.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\mr.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):938947
                                                                                                                                                                                                                                                      Entropy (8bit):4.476005642636115
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3E1DEF501525512978C2B6372F979002
                                                                                                                                                                                                                                                      SHA1:FCE5F22860456D8336C9ED0E33770AA2C843C3CF
                                                                                                                                                                                                                                                      SHA-256:1DFF66D6D91A081D3E6866EC2917F9081CA9E4DD46CF0A94C985F9E759C3D6EC
                                                                                                                                                                                                                                                      SHA-512:41B9B838ED8CE819ED4DCECD36D5F9A7C19792CF1ABAFA6EBFF7F3E00504298D869B3AF18BF85092A89817F63D5D19C097A5F8263B7BA035DF8B792B76E09981
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.R...h.W...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................t...........j...................................5.....b.....8.............................E.................3.....u.....A...........u.................}...........7.............................6.....9.........................................&.....D...........-...............................................V.......................:.........................................?.....w....._.....5.......................X.......................X.......................k.................5.....^..... ....._.......................@...................................o.................7.....2...........H ....2!.....!....P".....".....#.....$....N%.....%.....&.....'....Q(.....(.....)....4+.....,....D,.....-..........B/...../.....0.....1.....2....@2.....3.....3....:4....c4.....5....x6.....7

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\mr.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ms.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):447382
                                                                                                                                                                                                                                                      Entropy (8bit):5.28224913603811
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3B2E87D63A91A833C677F965C04297D6
                                                                                                                                                                                                                                                      SHA1:9AD268F1EB2AF1C453FE22CCBD54743FE6CE6B04
                                                                                                                                                                                                                                                      SHA-256:7F092467CE9E3146E3F060ECB0CF3DD19E1995C39597368CF6CD9DC78A3F864E
                                                                                                                                                                                                                                                      SHA-512:DC1B936F9B2F8A8F2FF90963B4D28DAF850991A035F92B90BDD1D962176A22D01F5B624A04F5F3E28BDD3D20A65D4EAB6758BDAC5254C8533353828B150F0530
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.'...q.-...r.9...s.J...t.S...v.h...w.u...y.{...z.....|.....}.....................................................................................$.....;...........B.......................s.................*.......................\.......................v.......................l.......................n...................................M.....e.................2.....;...............................................&.................j.....|.................(.....:.............................X.......................>.......................K.......................D.......................4.......................$.......................2.......................U.......................=.............................d.......................M.......................-.....E.....Q.................C.....R.................`.....y...........p.................B.......................Z.......................6.....~.......................^.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ms.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\nb.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):437481
                                                                                                                                                                                                                                                      Entropy (8bit):5.425985328231196
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:94DF2E13FAFA74C40A31212D6961D9B4
                                                                                                                                                                                                                                                      SHA1:A15B17925D9B08B5AD1E17834BC3AEB14C25E22A
                                                                                                                                                                                                                                                      SHA-256:CDB143239D7665CD2BBAA09356DF53ECBFAEDF8F7461996F67743A117D805EB3
                                                                                                                                                                                                                                                      SHA-512:A5CA256AB103243E197E3B1091EDFA87D51E9687F80BFA037B30AC876618787695915D8E4CDB8B05EE441AC828FF54182C270A8E22E1E45ED00FCD834164C082
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.'...t.0...v.E...w.R...y.X...z.g...|.m...}...............................................................................................................................j.................B.................0.................'.....>.......................,...............................................5.................W.....z.............................a...................................b.....|.............................[.......................$.....|......................._.......................[.......................g.......................m.......................b.......................Y.........................................5.............................q.......................V.....x.................w.................H.......................N.......................c.......................q.................+...........:.......................u.......................P.....m.....{...........E.....t.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\nb.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\nl.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):451052
                                                                                                                                                                                                                                                      Entropy (8bit):5.363007925700961
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:13F0961EC531CDFB00AEEAD580C6B8BF
                                                                                                                                                                                                                                                      SHA1:CA4872915B8E6F4FF77E022C3C2E151552E0C68B
                                                                                                                                                                                                                                                      SHA-256:B9065BD8ABF6BEA1DE64EF534E4BAEC419F422EF21189D9FE7D42FE949C4A70B
                                                                                                                                                                                                                                                      SHA-512:1BC850224C94128546B5BAA614686A0C59D8FD9E2376845EE8F819CC7D39BDB7625F1EA2C9C4F0FFBE0F1C9357DC2D86355B567543390459B3D73D0A02C0EFAB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.!...t.*...v.?...w.L...y.R...z.a...|.g...}.y...........................................................................................................N.....c...........2.....o.................j.........................................3.............................n.......................|.................L.......................c.......................l...................................A.....W...........K.......................N.....r.................!.....E.....S.................!.....2.................0.....A................. ...........~.......................[.......................H.......................[.......................}.......................n.......................Q.......................U.......................q.......................S.......................r.................%...........).......................~.................R.......................I.......................7.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\nl.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\pl.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):498162
                                                                                                                                                                                                                                                      Entropy (8bit):5.741520130097087
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4EA1D17290B7E3D412C50C991428AAD7
                                                                                                                                                                                                                                                      SHA1:CF9CCED4F53A185AB399BEEB9216231B5A8FBA07
                                                                                                                                                                                                                                                      SHA-256:1638385F5841E57796BEFF0B247307DD72E95784131BBDD91E408E6888510490
                                                                                                                                                                                                                                                      SHA-512:89FA088334F9AA7C1160330C886151C333C15E4F8A3B7C2FA320FC5AF91CD2404D7966284D1F82F876F0DB67730839ADC314520E7535735B89C9773424193593
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p."...q.(...r.4...s.E...t.N...v.c...w.p...y.v...z.....|.....}..........................................................................................."...........S.................A...................................O.....m...........0.....q.................<.....h.....|...........G.....{.................d.................@.................).................+.....D.................>.....Q...........N.................E.................=.............................b.......................*.....t.......................l.......................t.......................n.......................Z.......................R.........................................4.............................].....~.................S.................".....{.................N.............................|.................F.......................}...........A.....W...........M.......................u.......................D.....b.....q...........G.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\pl.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\pt-BR.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):469212
                                                                                                                                                                                                                                                      Entropy (8bit):5.427870477463905
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E76567E7CB1781755DF1C9EF3194167B
                                                                                                                                                                                                                                                      SHA1:295D083D51A2DFCDD1232945ADAC38EDBDF37CC5
                                                                                                                                                                                                                                                      SHA-256:6BF374CA987034769785EBB94DD4162B53924F83E8923D5EA3AA4E109068AA11
                                                                                                                                                                                                                                                      SHA-512:E0564D5A041C4A17AD9690B67857698C135852E8E220EDC1CC3C6B7E532752D2279470C8E38F0F055033EEB98E7FCEF46137DC562D8866836B9CD7948A2EFDC6
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.(...s.9...t.B...v.W...w.d...y.j...z.y...|.....}...........................................................................................+...........@.................!.......................`...........L.....i.................h.....}...........#.....M.....].................<.....U...........I.................E.................#.................;.....L.................Q.....e...........S.................K.................;.............................j.......................h.......................k.......................n.......................P.......................*.....~.......................s.................@.................".....u.......................D.......................g.................;.................;....................... .....k.................$.....u................._...........3.....I...........J.................#.....q.......................I.....o.................\.................*.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\pt-BR.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\pt-PT.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):474164
                                                                                                                                                                                                                                                      Entropy (8bit):5.40021699490739
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D982AF2F9B7AC7A3422AC809979C0060
                                                                                                                                                                                                                                                      SHA1:F40E420CB9F97C335E788C49C0EF6428E08B68DD
                                                                                                                                                                                                                                                      SHA-256:D850E85C14B08823584862CDD810315455C1D23F7E51956A0401611751AA18AD
                                                                                                                                                                                                                                                      SHA-512:64183795EC2EAEB1B565774B5B9B8373D4F811837DC6B21D0822EA4771CAED7C5152C70EFE2AC297C15F7F6904DA0E65B0B1C16D00B252CD42DA5E1F384631ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........&!}.e.....h.....i.....j.....k.....l.&...n.....o.3...p.@...q.F...r.R...s.c...t.l...v.....w.....y.....z.....|.....}............................................................................... .....5.....G...........[.................9...................................h.................n.................%.....y.......................Z.........................................m...........%.....E.................^.....k...........&.....j.....z...........L.................(.......................x.......................c.......................[.......................k.......................s.......................^.......................7.............................{.................1.......................[.......................3.....s.......................b.................".......................Q.......................2.......................=.......................|...........W.....o..........._.................D.......................S.......................F.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\pt-PT.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ro.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):488236
                                                                                                                                                                                                                                                      Entropy (8bit):5.455703860989617
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:DADDAA3E835A9373E66EB86A5409E960
                                                                                                                                                                                                                                                      SHA1:1358FB2EF112C5EB7E70A0C99EADD12376C70A2D
                                                                                                                                                                                                                                                      SHA-256:065B6F20EF8B354F61BD9FC244385E7650BDF43820CBB96A83A47658E6D864DB
                                                                                                                                                                                                                                                      SHA-512:3D4377966DDE1473227A4DAE3A22D4899DD819E1B3F02920C62BD3389F2C22DF0166962813FADF2AEE1F12C66691C295ACEE4C9D075269B6BD0387515BBC6F43
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.!...t.*...v.?...w.L...y.R...z.a...|.g...}.y...........................................................................................................b.....|...........=.....v...............................................-.....L................."...............................................+.....\...........J.................'.......................Y.......................p.................,...........<.......................^.....|................./.....T.....h.................-.....=.................(.....=.......................4.............................b.......................A.......................\...........$.....>.............................`......................._.......................z...........%.....e.......................-.................D....._...........#.....c.....x...........u.................j.................@.................O.....g.................).....?...........%.....|.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ro.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ru.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):771792
                                                                                                                                                                                                                                                      Entropy (8bit):4.998193065460115
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:619A163F3F001CCC7AEC2D8EA7896F45
                                                                                                                                                                                                                                                      SHA1:B671D6F771EF0A83A676A6B03232218A379DF3FB
                                                                                                                                                                                                                                                      SHA-256:8C9FA3C306711C0847A9C81BEBD835C6F31DEF21FEE215671931E90652683C51
                                                                                                                                                                                                                                                      SHA-512:F037247E08B9EDCDAF9B8BFB2180B1D8E499FD3289616A0DC0B7C1F23164A8049C90382F767B9362396A2D1D697A016D2D87CD93A1F27141D008AEAC88796D64
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........} &.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~....................................................................... .................&.....E.........................................6.....d...........r.......................N.................+.....}.......................#.....~.................p...........1...........}.......................<.................i.....7............................._...........0...................................0.....O...........<.....m...............................................m...................................o.................:.................X.....q...........N.............................*.....N.................F.....a...........|...................................g...........N.....v...........;.................2...........o...................................4.....?...................................E.....d...........].......................:.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ru.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sk.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):499035
                                                                                                                                                                                                                                                      Entropy (8bit):5.793845772544824
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:10E36351C04D2014479A78CF2CE9719E
                                                                                                                                                                                                                                                      SHA1:DF29E7C8FAD25D2A6A30870E1CD8D0A799BCEF51
                                                                                                                                                                                                                                                      SHA-256:AA6FB1BEB03C1A5B08D61DC45C985E5B15498D775BB93A204B1A49D63A2E95B7
                                                                                                                                                                                                                                                      SHA-512:0715B0D3A189948BD7DCB899F3ECAD56A626A23E3D24541A0B22A6E6397623820C88D5B41598B1C3B6FEA57183386DB9558893C03646FB4A8267C456DF4308FE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...|.v...}.......................................................................................................^.................b.............................1.......................k.................%.......................+.......................A...................................\.................v.................<...................................:.....Q...........v.................D.......................).......................".......................$.......................^.......................s...................................2.....E.................Q.....d...........~.................3.............................e.......................`.................8.......................z.......................~...................................K.....e.........................................C.....d...........5.....d.....x...........'.....I.....]...........T.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sk.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sl.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):482831
                                                                                                                                                                                                                                                      Entropy (8bit):5.48369452183905
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:55C9BC2AC28DD6DF70702AB4288519BB
                                                                                                                                                                                                                                                      SHA1:C636B766B3427685F951F9605A84D66D8593FDBD
                                                                                                                                                                                                                                                      SHA-256:CEE8EEBC1117E65A69E5C2AE7A72EB52D3F5F8A863CBE41638310D7063B23279
                                                                                                                                                                                                                                                      SHA-512:140C099649DDFD2C182157E8CED83B06C125706C028E77C7FCDFE732CE4080745A2ECCBDB9A5BB4C3942BF07AE5DD978D38937463C7ED7D7AB9D02CF4F9DA4AB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.+...w.8...y.>...z.M...|.S...}.e.....m.....r.....z.............................................................................x...........Z.....s...........I.....z...................................k.......................p.......................b.......................t.................6...........#....._.................^.........................................N.............................1.......................^.....u.................?.....b.....r.................W.....j...........M.......................d.........................................C.......................D.......................S.......................w......................._.......................V.......................}.................P................. .....6.................=.....Q...........".....a.....y.................5.....N...............................................,.....~.......................p.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sl.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sr.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):722396
                                                                                                                                                                                                                                                      Entropy (8bit):4.94233616273736
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:764FC3698AC18A50623D46DA933831BD
                                                                                                                                                                                                                                                      SHA1:82F060252E58CBD1C51A37CF4C227E7506A2DE8A
                                                                                                                                                                                                                                                      SHA-256:679743F42FE47CC21AE4770941080D9730A8CB868331EB8E6DFB71ABA523604E
                                                                                                                                                                                                                                                      SHA-512:78909E20FB89FAD51D99152AEDCC3DC09BBFA5C187068ED9FEBEA6021182B4D366A8FF46F10076D67822285340269031EABD78D4A4C2167B0AEA9A2A63813022
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.&...q.,...r.8...s.I...t.R...v.g...w.t...y.z...z.....|.....}...............................................................................,.....Q...........s.....0.......................M.............................6.....j.....A...........[...........7.................1...........4.....{...........d...........S.................L.......................t.......................T.......................x...........+.....7.......................}...........$.....F...........K.................4.............................].............................e...............................................d...........+.................%.......................F...........L.................K.................'...........m.......................6.............................2....._.....!................./.......................@.....-.............................H.......................G.................E.....................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sr.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sv.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):440166
                                                                                                                                                                                                                                                      Entropy (8bit):5.527600996955519
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A87B6D35CFE2F86AA731AB9935089E3B
                                                                                                                                                                                                                                                      SHA1:BA78688E14D7D6631047858E069C55E326AE2FE2
                                                                                                                                                                                                                                                      SHA-256:4BFCAF23F9BF5DABB9CB05A868654F0FE2CE9D36C1C8C05849F8122F0DDF1235
                                                                                                                                                                                                                                                      SHA-512:5FC0736CA6BBA0F003CAD4D043038DB57D21362C055A4587DC9B2644B25A02194565F82AD151D7DC18F4C3C4A90C5D015C17C3B31692C774F5999802DA5A37ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.\...h.a...i.r...j.~...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.-.....5.....:.....B.....J.....R.....Y.....`.....g.....h.....i.....k.....|.......................9...................................+.....<...........;.......................t...............................................~.................7.......................u...........-.....M.................6.....E...........#.....a.....q...........m.................i...........W.....v.................8.....K.......................-.............................t.................&.............................v.......................f.......................].......................h.................%.....}.......................V.......................(.....w................. .......................M.......................<.......................:.......................U...........7.....K...........7.....r.................d.......................A....._.....m...........+.....Z.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sv.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sw.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):460837
                                                                                                                                                                                                                                                      Entropy (8bit):5.356256987882625
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4FA48F6B14AE1C0C91E6A6B9698D8030
                                                                                                                                                                                                                                                      SHA1:8394200D1382A1C178B98E8774CB92CD79442D6E
                                                                                                                                                                                                                                                      SHA-256:2081C3DD167D916E7867AA4DA856648E0962659B1081436F2BC802E772C443A2
                                                                                                                                                                                                                                                      SHA-512:9F8419DF7B40ABAE05471B54835764E032EC66533CB33AD57FBFAEE33B2931192D48343E97427441E0DFC7AB5327469A98B3F896666E7F421730B1337FF51EDB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...|.W...}.i.....q.....v.....~.............................................................................|...........K.....a...........0.....o.................t.................9.......................+.....~.......................c.......................m.................O.................3.................?.....O.................5.....C.................D.....X...........g.................:.............................X.....{.......................D.....P...........3.....~.................=.....q.................G.......................7.....f.....s...........-.....f.....o...........S.......................e.......................o.................1.......................M.................$.............................Z.......................h.................*...........$.....|.................r.................[.................%.......................3.................b.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\sw.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ta.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1132527
                                                                                                                                                                                                                                                      Entropy (8bit):4.208230669652696
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D1BDAB6B9159FE626AD90E254A86E927
                                                                                                                                                                                                                                                      SHA1:979B0AB979522A8A72AE4151284C52F5EFC413BD
                                                                                                                                                                                                                                                      SHA-256:B0D0730F8EAA23BC6CCEB9EAC0194D173CDE81FCD8FA6EF0690DD80B0ED89C84
                                                                                                                                                                                                                                                      SHA-512:356946DE5BDF1EDDC96726C15F7BD83ADD60DF4F05024491B712E9F7F0F192334DE3E924A60D9D5C0488DDC683261ACCF606333CBAFB3B773FA28A2DC86131C8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.x...h.}...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y."...z.1...|.7...}.I.....Q.....V.....^.....f.....n.....u.....|.........................................&.......................H.....q.............................u.......................<.....r...........@.....A.....4...................................'....._.....c...........N.......................*.....K.....a...........G.................S.................-...........\.......................e.....h.....1...................................4.................R.......................M.............................4.....".........................................C.....=.......................6...........c............ .....!.....!....;".....#.....#....B$.....$....h%....Q&.....'....i'.....(.....)....#*.....*.....+....F,.....,.....,.........../...../...../....x1.....2....l3.....3.....5.....7.....9....?9.....:.....;....]<.....<....=>....c?.....@....t@....xA....eB.....B....%C....WD.....E....$F

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ta.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\te.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1048884
                                                                                                                                                                                                                                                      Entropy (8bit):4.462517009279803
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:273290F2F03A430C463E8C980F9E50F3
                                                                                                                                                                                                                                                      SHA1:02A7345C7AE3849ADFA6A0F1099C0FCC36BAA63E
                                                                                                                                                                                                                                                      SHA-256:D8A570353F1549C4562866EE8B6027523247EAACDFF9D1B93955470B6F40277A
                                                                                                                                                                                                                                                      SHA-512:6455A3EB120D514A029CD4C91422FDA3042B8033869EB30D13269D85D831F0F2E0ABF9A71D8BD84C36AA9D21A4F87F0F95C8C2DED02B2FA1695C5FB078E5009B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........#!..e.....h.....i.....j.....k.....l.)...n.1...o.6...p.C...q.I...r.U...s.f...t.o...v.....w.....y.....z.....|.....}.........................................................................6.....j.........................................n.....`...........I.............................K.....d...........>..... .................Q.....`.....0.............................D...........'.....Q...........}.................=.....~.................A.............................V...........<...........v.....a...........f.............................5.....I...........y...............................................g.............................W.....v.....F.................#...........q.......................................... ..... ....8!.....".....".....".....#.....#.....$....@%....x%.....&.....'...._(.....(.....).....*.....+....Y+.....,....w-.....-....H....../....K0.....0.....1.....3.....4.....5.....5.....7.....8....G9.....9.....;.....;.....<.....<.....=.....>.....?....X?.....@.....A....[B

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\te.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\th.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):886579
                                                                                                                                                                                                                                                      Entropy (8bit):4.532231807164053
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7780E4EE7B6D1AB4379067C48F4CF159
                                                                                                                                                                                                                                                      SHA1:4EFA8BEB4F484C5BBF0F192BC30994DBC5D83EFE
                                                                                                                                                                                                                                                      SHA-256:696712F742A3DBE2310927548A3AB80E5C5A4CB1F31669A814851316C162AEC7
                                                                                                                                                                                                                                                      SHA-512:85A94547E56574D97A58D9A6C3AA91337D11C8FA9D48AF20CDF36F1FAC398C8B5FB30E0C4DE03CBB8E39098B52436837937E6FE316651B1DC9E408AD58D634F8
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........V M.e.J...h.O...i.W...j.b...k.q...l.w...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}.........................'...../.....4.....<.....C.....J.....Q.....S.....X.....|.................?.....\.....9........................................."...................................~...........q...........>....._...........{.............................<.................?.......................s.........................................................../.....g.....V...........T.....3.................Y.....%...........@.....a.....!.................0.................8.....b.....4...........U.....y.....E...........f...........@...........5.....P.....%...........F.....m.................H.....p.....*................./...........k.............................p.................u...........{..... .............................].......................l...........1.....4.......................3.....$...........E ....8!.....!....i"....."....O#.....#....B$....a$....j%....3&.....&

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\th.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\tr.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):468536
                                                                                                                                                                                                                                                      Entropy (8bit):5.616090976999539
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1BA9F7E1C5E827860D0629014D756A00
                                                                                                                                                                                                                                                      SHA1:DBB92B8901709F41FA85E6C2A6196C44BF3FDC13
                                                                                                                                                                                                                                                      SHA-256:6D157F326C9F0088C1580D5B3DB5BE1546A2C7FF0C860074F55B2CA1085E88F0
                                                                                                                                                                                                                                                      SHA-512:6DCF8583F1FCEAD60C140AF62E48B16AD671C42C2AC2438A08CC80385B3EB4C9D8D252952B04871CCF334BF06324FA822F1AAAA99CBF7A06788BD34D3F0F54F3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:........"!..e.....h.....i.....j.....k.....l.....n.$...o.)...p.6...q.<...r.H...s.Y...t.b...v.w...w.....y.....z.....|.....}.....................................................................................2.....L...........o.................N...................................C.....^.................Z.....m.................=.....L................./.....A.................C.....e...........X.......................}.......................t.................).......................t...........,.....D.......................J.................8.....I.................3.....C.................E.....R...........!.....X.....i...........*.....\.....i...........%.....U.....a...........&.....Z.....g...........l.................>.......................?.............................s.................2.......................P.......................7.......................O.............................M.................e...........!.....E...........K.......................q.................+.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\tr.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\uk.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):771174
                                                                                                                                                                                                                                                      Entropy (8bit):5.034185565907101
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:18B1A3E297FEED3729177908E9BFDEBE
                                                                                                                                                                                                                                                      SHA1:5380FAD32AF5DE6E502D80FD9AD069422AA26DC4
                                                                                                                                                                                                                                                      SHA-256:DDC042E753E223B5D2003CBA9E8A8A212BF33D7DF247DCFA05AEBAE1597856C0
                                                                                                                                                                                                                                                      SHA-512:64D58531230AA21A57D3E8B5E5B8048D4A04BD0EB7053C52FBA7CE255FBD04F02B29DE36636C761499E2B1186163B16C35CBEF237732A835A10C1B36218E83EA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.B...h.G...i.X...j.d...k.s...l.~...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}............. .....(.....0.....8.....?.....F.....M.....N.....O.....T.....q...................................$.....C...............................................L.....'.................n...................................C.................l...........X...........~.....?.......................J.................v...........j...........Q...........i.................J.............................5.....h...........q.................Y.............................}.......................%.....u...............................................Y.....x.........................................K...................................o.............................t.............................)...........1.............................).....m...........q...........w.................i.........../.................Z...........K...........1.....T...........[.......................9.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\uk.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ur.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):678309
                                                                                                                                                                                                                                                      Entropy (8bit):5.314848091341466
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:F2080E238404C45ADA98CA531E88A22B
                                                                                                                                                                                                                                                      SHA1:5375213D91649189EA01F2C0C1E055A899F8407A
                                                                                                                                                                                                                                                      SHA-256:D4AB2D065B60D4BDFAC5C45A38DD889CE1D0E9D769207DD4D8EA65A7C13818D3
                                                                                                                                                                                                                                                      SHA-512:CA657C89EE754A51ECDE7313EC5FD1ED8118C35885FAAF8B1A6BABDE67D7272A8C13FD1386CD790236FB15A898AD0D489FC2DAD2CB7497C2AA2AC9CD043FC306
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.........!..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...|.b...}.t.....|...................................................................................*.................H.....o.....+...........;....._.....>...........z...........b...........i...............................................g.........................................i.......................C.................d...........`.....}.....P.............................[.............................9.....a...........L.................%...................................`.....~.........................................f.................~.................i...........7.....S.................@.....k...........{.................q.................-...........4.....z...........b...........^...........,.............................3.................}...........w...........x.....,.......................d........... ...................................%.....j...........<...........#.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\ur.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\vi.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):548715
                                                                                                                                                                                                                                                      Entropy (8bit):5.8169786739645835
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:360E4F740ED214A6B964E62FD57ACC84
                                                                                                                                                                                                                                                      SHA1:D543772D1ADD0822513FA8EDD48F211D4AF16982
                                                                                                                                                                                                                                                      SHA-256:F6030F21C88AF7769CA19AB0F4E518388FBFAD1376B409124F124A60DC045A48
                                                                                                                                                                                                                                                      SHA-512:0E555AC51C73AD57789350920BA160E88D39C6D83FEF45598E22AAA6856B2BE301D0E6BBFEEC55F962D50E6E462EB2A92BACBDBF972E31C162A004D78A279962
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.4...h.9...i.S...j._...k.n...l.y...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....|.....}...................#.....+.....3.....:.....A.....H.....I.....J.....L.....].....n.................n.......................8.................$...........a.................v...........C.....\.................+.....7.................E.....X...........w.......................W.............................].....o...........n.................v...........[...........:...........7.....c...........5.....^.....}...........].......................x.................G................."................./.....@.................>.....M.................I.....W...........<.....z...........8...........>.....\...........J.......................z...........%...............................................`................. .................X.....{...........u.......................9.........................................;.......................].............................>.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\vi.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\zh-CN.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):407331
                                                                                                                                                                                                                                                      Entropy (8bit):6.753245960246669
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:21199103AE06024BC6A5D60778971E16
                                                                                                                                                                                                                                                      SHA1:C11690D0EDBD708843DF2BCB8A6964FE5C1E9581
                                                                                                                                                                                                                                                      SHA-256:A37692DA02399597D14DBF99339EBFD247750CA480A8D90BB3D8A69F040D4FBD
                                                                                                                                                                                                                                                      SHA-512:7644315BD7DFC458F10C613FD44A316787F5F838682EE92BE777B2D4C441F8E2DB8977E6884BE8BA8CD7AB041F52371D8B206E7CDAEA00AF43657529B43BCDAB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... ..e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.7...v.L...w.Y...|._...}.q.....y.........................................................................................{...........A.....S.................6.....B.................C.....U.................V.....k.................9.....E.............................p.......................p.................-.......................*.....}.......................c.......................j.................!.....m.............................w.......................<.....\.....k...........6.....s.................*.....S....._.................?.....K.......................".....u.......................x...........#.....7.............................`.......................R.......................5.......................$.....g.......................F.....o.................C.....x...................................F.......................U.......................%.....l.......................M.....z.............

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\zh-CN.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\zh-TW.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):403888
                                                                                                                                                                                                                                                      Entropy (8bit):6.760833853560909
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A011C6D7FD33D1B8E1EE165D57F8070A
                                                                                                                                                                                                                                                      SHA1:9F91B7E9E065851E98DCF1766077C704429EE632
                                                                                                                                                                                                                                                      SHA-256:389E601EC1D00D91FFE0D483C7BA8E3DCC86473A78AB24FA4FE2FBCD3C9478F6
                                                                                                                                                                                                                                                      SHA-512:010262B1B2FC6BF85F4C8F6FE91F28F999C3466746BA981028FE458CC909DD9713CD85FE349CC4648D713A91158E8EDCCBE1B884BE52EA0739BC0C6D91F4003D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:......... !.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...|.T...}.f.....n.....s.....{.................................................................I.......................e.......................Q.......................M.......................5.............................[.....|.................9....._.....y...........6.....e.....z...........-.....[.....h.................9.....E.................@.....R...........*.....h.....z.............................x.......................@.............................i.......................F.....o.....{.........../.....^.....j.................8.....A.............................................../.....{.......................A.......................[.......................D.....u.......................2.....>.................................................................N.....]...........,.....d.....y.........../.....X.....d.............................^.......................N.......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\Locales\zh-TW.pak.info (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:CSV text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1051715
                                                                                                                                                                                                                                                      Entropy (8bit):5.421097189144176
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C54C8E48DB7B06D5D73186CE47050A51
                                                                                                                                                                                                                                                      SHA1:782646FEE0D53A4BE914B0EDD1E7459349CCF870
                                                                                                                                                                                                                                                      SHA-256:7036DA5AE3A96E54A0F4A44C25A6522DE4FDD77B5A91801207D90BF37509E035
                                                                                                                                                                                                                                                      SHA-512:AD7407DD74925D03443B706B31FD54EB78E4A9F7612CF949EE3EA6882FE05B35B846B4EEBE4EA7B2CE055054FB70D38C459FC41130002BA37427DEE74FB8C33B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:IDS_ACCESS_CODE_CAST_ACCESS_CODE_MESSAGE,1400,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_BACK,1401,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CAST,1402,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_CONNECT,1403,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_DIALOG_TITLE,1404,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ENTER_CHARACTER,1405,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_ACCESS_CODE,1406,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_DIFFERENT_NETWORK,1407,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_NETWORK,1408,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_PERMISSION,1409,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_ERROR_TOO_MANY_REQUESTS,1410,../../chrome/app\access_code_cast_strings.grdp..IDS_ACCESS_CODE_CAST_E

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\MEIPreload\is-8OJ83.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):238
                                                                                                                                                                                                                                                      Entropy (8bit):4.824253848576346
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:442699C95B20A60470421C6A4D29960F
                                                                                                                                                                                                                                                      SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                                                                                                                                                                                                                                      SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                                                                                                                                                                                                                                      SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\MEIPreload\is-U7VTR.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8254
                                                                                                                                                                                                                                                      Entropy (8bit):6.795641289553097
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                                                                                                                                                                                                                                      SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                                                                                                                                                                                                                                      SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                                                                                                                                                                                                                                      SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\MEIPreload\manifest.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):238
                                                                                                                                                                                                                                                      Entropy (8bit):4.824253848576346
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:442699C95B20A60470421C6A4D29960F
                                                                                                                                                                                                                                                      SHA1:C7317F2D2414C991C21205BA3C68A187B997E3C1
                                                                                                                                                                                                                                                      SHA-256:44844CF3DDE6E80087AE0E6BF0D9326D7EF7D23326D24AC83AF0850BE26923D2
                                                                                                                                                                                                                                                      SHA-512:C89CF089F7FEEB80C6DED11F1FCE84287ABE8216A6E05723D1A7FAF567C501C043CD1246FF8DBEE1240D2D79C41B698EF4CC3459589E68E5BFC5BED7FC3A150B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "name": "MEI Preload", . "icons": {}, . "version": "1.0.7.1652906823", . "manifest_version": 2, . "update_url": "https://clients2.google.com/service/update2/crx", . "description": "Contains preloaded data for Media Engagement".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\MEIPreload\preloaded_data.pb (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8254
                                                                                                                                                                                                                                                      Entropy (8bit):6.795641289553097
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D5E4C2634EFF8A9B3FAF432BF406D6D1
                                                                                                                                                                                                                                                      SHA1:A691F5C9877079193C1F7DFB16DBC30BB0372EC9
                                                                                                                                                                                                                                                      SHA-256:C6070A157B4E28D16FBCCBD233E93846DDB070C85E1A1BC64469B7A5F1424FAD
                                                                                                                                                                                                                                                      SHA-512:B264E28AC8F111DF01C553445AADC7BCDB3F32A38A1A19D3F9D458270DFEAF80EFA7144407BD999892022AF9DDE9DBF8A0E19E7212720E1C6511EA9125AFB166
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..@5..0@...@y@o@.AK@X@.@w.!@.@.@.A.A.@.@B@.@.@.<A.A2A_..6strea.....kpo..anim..^...elo.tele..g....pan..bancidiz...don...Ikor........D...ap.cuem...ukleren.squl......ve..vco.. ....sten.tid..+v........dou...myvrs..=bb.jl..#streamfai..P2...nkk........10...f..R527......p...7............85.231.223....11.90.159.13...movie..w23serie...3tv.co...h...pla...00mg...bstrea..W93.178.172.11...49.56.24.2...........secure...|qo.....routk..nitetv.roge..}map...ndavide..ci.t...view.abc.ne..O...j....lianonlinenetw............r..'oora4liv......8.topgir..33.sogirl..rshow12...ayospor.......mc..s...k......sian..nime.c..n......prof..ba..Mtochk..Zkra..Tg...-....K............@.'..2.vos......m..rig...r.. ......@g..>..........perpl..)...tualpi...gintvgo.virginme...eo...mbox.skyen..@aplay.O.E0B...d....W......portal.jo.._...e...ma..........Lsearch.ya...frida......a..Qhnex..jvarzes..ey...........e....y...d.tv...stfr......l......seigr..U...d...q.....z....serial...r...cuevana..Amovistarplu..a.......f

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\chrome.7z

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):378663861
                                                                                                                                                                                                                                                      Entropy (8bit):6.816341965354311
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1B437F91911CE00511EA84A61BD941BE
                                                                                                                                                                                                                                                      SHA1:97DCC635AE3E27EF8DD27F09337549CBF32A64B6
                                                                                                                                                                                                                                                      SHA-256:D09D4F854D77BFFC33B64C4EA9755D104A66F9164F03289F17C73C7BDE02E121
                                                                                                                                                                                                                                                      SHA-512:84EDD4CF7F761F86FF26EC83A0986E582261BD88FE59679C4ACA406EC1E59A41F6B6B7F99A2E22D53713133EA07A4D5700A70EE158785EFD0232EECC04B2D9FB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:7z..'.....>o......&.........u.<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='127.2.2.1372'.. version='127.2.2.1372'.. type='win32'/>.. <file name='shift_elf.dll'/>..</assembly>..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...;............." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\chrome.packed.7z

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):102816549
                                                                                                                                                                                                                                                      Entropy (8bit):7.999998085539242
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6DB72577CCA455B637004C6AF9FB560D
                                                                                                                                                                                                                                                      SHA1:D5FC45584569CDC923B5B9A47714FDBAD46EF8ED
                                                                                                                                                                                                                                                      SHA-256:6DEF106DB59F0D3C7465C1F35DD658C1A5BD9CA827595E524CB545F989F87616
                                                                                                                                                                                                                                                      SHA-512:F746C9BA4D9974B3523CCB745A754319BA3C73929CEEC796A3C8796C31A3D99637721C7B3EC467F2AB71AC8AA9AB0349A69B58B304FECBA826FA66BB26B21354
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:7z..'...e...w. ..............E\.......8%D....z].dpF0x.E.K~.k.....D.\.l.r.:_....*..Db.)d...+kt .9|m.....H.M..E.6.p......=..c6O.xr.@...mi....7.5R....x..Y'...mz.$.#. ..i&..u.6K...uT..^74*.e..K.:...d..Dt..dT&.b....r....:....&..?.t.IG.....6K..,.o.|.....5].V,...e....uO~...:.....I}VE&l3.& ..q*.U..6.pYO....G.TT.....~?....A....('y.\b....7.R...C.._.[.6f.T...P.u.EJ.^....'.".x...a.j.K2;..Kg.5t.-Sx;up......Pt.Db.oG...MF.).....8]3Ns.W..h.cs..L..\w......Z0#-5.[..A.C..MF..2..>H......3...)X.O.m.iWq..dc.......d....:...d$.K..XD..rQ...]...).X...`.q..{2..e...F...z.?..4..!.eg.Q..3%.{.~Pkb.Y/.T..e.....H.%.<T=T.+A....m...._N J.N...)..=.O.y...@1n....,.F{d?..se4x.yX....c.*6..M.Z......R.E..R.....D..z.]..E.=..}....t..L....'I....x..V...Q(..R..../...z*.$.4.:C..O.s.?...../b.N....+]b...X.....R .si.B.E.L.<....:..C...P.O..L.;.-.bl..N.E...9..;sr...(..ir7.....Ls8...@.e.5..4.._.^..c..x..}Wse.....}...51.}...z.*..P..8.=o.....jQ.b...c.)%..&...0.V..r..k...Z..0..o.<a

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\d3dcompiler_47.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4916728
                                                                                                                                                                                                                                                      Entropy (8bit):6.397948646164362
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:03A60A6652CAF4F49EA5912CE4E1B33C
                                                                                                                                                                                                                                                      SHA1:A0D949D4AF7B1048DC55E39D1D1260A1E0660C4F
                                                                                                                                                                                                                                                      SHA-256:B23E7B820ED5C6EA7DCD77817E2CD79F1CEC9561D457172287EE634A8BD658C3
                                                                                                                                                                                                                                                      SHA-512:6711D40D171EA200C92D062226A69F33EB41E9232D74291EF6F0202DE73CF4DC54FBDD769104D2BB3E89DC2D81F2F2F3479E4258A5D6A54C545E56B07746B4C4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...;............." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\icudtl.dat (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10717392
                                                                                                                                                                                                                                                      Entropy (8bit):6.282534560973548
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                                                                                                                                                                                                                                      SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                                                                                                                                                                                                                                      SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                                                                                                                                                                                                                                      SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-0J1AJ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):686086
                                                                                                                                                                                                                                                      Entropy (8bit):7.963084561349391
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6BE00EC0C6F3C4B249A298BBE108576C
                                                                                                                                                                                                                                                      SHA1:823B17A2B2261BDBBD6ECCF0D5C98F11A28BE17C
                                                                                                                                                                                                                                                      SHA-256:289768986318853074605544E8D64476C23BCD21B5841D48D6E387936A091933
                                                                                                                                                                                                                                                      SHA-512:FE84BF6D9EB29D8501CA50D486BD36AE7235653747BEE004EF9C89E025CA9FE707284683ADFEC04C81BE9F5E08DF857180AB9549BA6F260057EA2F672425A9A5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..........Q...........................<.........p?....q?d...r?...s?8...t?....u?....v?d...w?...x?"...y?....z?...{?5...|?....}?...~?J....?.....?.....?F....?.....?y....?.....?....?-....?K....?.....?.....?.....?.....?!....?.....?.....?.....?.....?.....?i....?1....?.....?.....?.....?,....?.....?.....?a....?.....?q....?.&...?:'...?.'...?.(...?C)...?.)...?.2...?.<...?.P...?.c...?.q...?.r...?)u...?.x...?[....?.....?S....?....?.....?....?{....?....?Z....?}....?.....?.....?.....?d....?.....?.....?.....?$....?S....?.....?.....?.....?1#...?.+...?.3...?.9...?.A...?*C...?.a...?.z...?.....?.....?.....?_....?.....?.....?.%...?.8...?.a...?.v...?....?r....?.....?{....?.....?.....?:....?.....?.....?(#...?.-...?d4...?.<...?.D...?LJ...?.U...?.`...?.d...?.h...?.m...?/....?_....?.....?.....?.....?w....@.....@.....@A....@.....@.+...@.A...@KS...@.d...@.r...@.|...@.....@.....@.....@l....@.....@.....@.....@.....@f...&@....'@....(@Z...)@q...*@;...+@M...,@k...-@.....@(.../@....0@[9..1@S;..2@:>..5@.B..6@.I

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-256KS.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):10717392
                                                                                                                                                                                                                                                      Entropy (8bit):6.282534560973548
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E0F1AD85C0933ECCE2E003A2C59AE726
                                                                                                                                                                                                                                                      SHA1:A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
                                                                                                                                                                                                                                                      SHA-256:F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
                                                                                                                                                                                                                                                      SHA-512:714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW*..K..P.*..L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-2V23J.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):113664
                                                                                                                                                                                                                                                      Entropy (8bit):5.875781821689646
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FE8297D5F009F9500F282BCF6CCCA307
                                                                                                                                                                                                                                                      SHA1:59C7E96CF242FD8B88D6DC3920BB37B590DB2DBB
                                                                                                                                                                                                                                                      SHA-256:18C11487549F5073D32DBD1214A96ED75113EB86200577ED879BA542A64AC54E
                                                                                                                                                                                                                                                      SHA-512:1703D90A10BCB9D8BC70500976AFDFEB6C2748A6D326A2817319728F92A9F0887054288DC2BC6D331A569B39DE1655B8E8CE5E8B14CE2C4E2978A4B7B7B804FC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ......................................................................`A.........................................o.......p..(...............................P...lm..8...............................@...........8s..x............................text...s........................... ..`.rdata..............................@..@.data................~..............@....pdata..............................@..@.gxfg...p...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-31OF2.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7799296
                                                                                                                                                                                                                                                      Entropy (8bit):6.446718189372986
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C241BA50FDB83039FBFBD51DD2101302
                                                                                                                                                                                                                                                      SHA1:FC9C567A60A78A40FFC80C9ABD26D3E3D9B54556
                                                                                                                                                                                                                                                      SHA-256:0CB748C53CC721F248B649AB33512F0ADA3F2237633C01D35633C48545E5849A
                                                                                                                                                                                                                                                      SHA-512:96F3C7C914FBB7E9E439B3F54E6590B3ED523546DC1D47D9D1DCD47D3909E82A660286D3BB6AD93904FD03D983CF9A56768F8AACC24728EA63A6110945793C74
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ......Z..:.......}W.......................................w...........`A.........................................}n.....H[o.d.....w......Pt.$O............w.....<.n.8.....................n.(.....Z.@...........@`o......|n.@....................text.....Z.......Z................. ..`.rdata..DO....Z..P....Z.............@..@.data...\....0p.......p.............@....pdata..$O...Pt..P....s.............@..@.gxfg....,....v.......u.............@..@.retplne......v......$v..................tls....B.....v......&v.............@..._RDATA..\.....v......(v.............@..@.rsrc.........w......*v.............@..@.reloc........w......0v.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-3GQA6.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                                                                                      Entropy (8bit):7.600081069916784
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2D705C7AE5FC217935DC1D8113AFCDD8
                                                                                                                                                                                                                                                      SHA1:655B27F73E379CB6A4B2B6D7BE6C6590A494F47D
                                                                                                                                                                                                                                                      SHA-256:CDABF04991763A53E7BCF7C2E83CF8DB50B2F79AD659254081C1CE2CE489FDC4
                                                                                                                                                                                                                                                      SHA-512:63024BCFC87718FCD1E70AAA8A5540C1BF97A71E2FFB04631C4479E13CB1C0DEF695B71AE3362B1BCAF49533949F917444EF839D38643A2A939F5E9A5AD912EF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....0...0................_..H.?..;.0...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...191126212310Z..291123212310Z0..1.0...U....CA1.0...U....British Columbia1.0...U....Victoria1.0...U....Shift1.0...U....Client1.0...U....tryshift.com1$0"..*.H........shiftdev@tryshift.com0.."0...*.H.............0.........8;.i.W.......S..n./..ja......GE..l.J.|..~......t[m..ru....u.x.$X'...+....+;.#...K...u.......p....b....,....}k3..XAJ.?....)...uV...E...5=.@..@....~.r..}. .."5...Z@.1..c.../w........A.'..]......3de4........s....}.roM..$qU.R..>......e..o"(T.a......o0m0...U......j.Wgr....].5.Aa ..n0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...*.H............._.+....+..@...<.....v.K..)...X.......|\.-}..jf.x..8.@.D..Y\I....y.:..+.......,DBQo....t&.-U.Q....T...(.'...tw+]........e..^.C|y..S....@N.7=O.u.w.N.V..AN......K.m..MV.#2/Q.......r.{.x..``cj.Z'.B

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-3I1UL.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6910
                                                                                                                                                                                                                                                      Entropy (8bit):5.206278304311245
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5B52C922956FADBA0AC04E062BA7B58E
                                                                                                                                                                                                                                                      SHA1:3B5805BCD1D443EEC12812F1D6CAAFA9F9E2B311
                                                                                                                                                                                                                                                      SHA-256:1BFEA1F16B974C553D25E26367D43A413B076130366C1EFBD620C89A4E8BB352
                                                                                                                                                                                                                                                      SHA-512:5C1FEE2D4DED52D473B9DC694CD45F5A61E09494B605BB45889F850CF0F00A728760C18B06B31206FC20F04D6D8DCB34438E4248CD5B9D988F75D2AFCA3B23BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............H.*...0.B...\................{. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAia1M5QnDuWZyLm69sQ7FTTV+uCk7QQ3/ZZeWkFOo5cSBTtVumIJU5HcPyyGFkmDbN4zEpGATeYyxnbPPWuBPELcrjK+t3B7wgzyWU4pXb3nBxR9eHhejCPumlr0kHkAjvGRVkivIMLZYmOjKvkIqO4+tRGFIpcMRSVQtdfP7o9xocghOpuwI3awWtBHswEa8Nv52J1j1ErPmrWdatdMVs0GUWR5VJeb1GMCHpaquto/KaGzYtLHd7JFg2GcF7RpFinpvMLiw83Xp38bh5X7I3NlufYSuriZlpskiLrVRKYipKiXKEA5EMgW+0nYaN8SoAy0jf4JUaqkFYA5/WBsfPQIDAQAB",. "manifest_version": 3,. "name": "Shift",. "default_locale": "en",. "version": "1.0",. "app": {. "background": {. "service_worker": "service-worker.js",. "type": "module". }. },. "content_security_policy": {. "extension_pages": "script-src 'self' http://localhost:8097/; object-src 'self'". },. "display_in_launcher": true,. "display_in_new_tab_page": true,. "offline_enabled": true,. "permissions": [. "bookmarks",. "background",. "cookies",. "declarativeNetRequest",. "declarativeWebRequest",. "downl

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-7N7R4.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1170944
                                                                                                                                                                                                                                                      Entropy (8bit):6.41515711083642
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FA873BA1DB4398F0B32BF77B6ACCBBB2
                                                                                                                                                                                                                                                      SHA1:A11F6B6673967FE4623F319457E2D096676470A9
                                                                                                                                                                                                                                                      SHA-256:64DC398C79FBEEFBFCA7403211E04D0A4613EBA0420AF32D6196B8DF56BA070F
                                                                                                                                                                                                                                                      SHA-512:E1CCE4F46ECAB0F73A58112F6B5DC9F89ED7C3B0B0DF417798297E78F9B2A4EAC1C62AF63FF6D2D25E293EA3CB45DF9612BE1115139E1231156570FC5965EFAF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .....,................................................................`A.........................................o......6s..P.......`.......d...............t....^..8....................]..(....@..@...........Hy......Pk.......................text....+.......,.................. ..`.rdata..$....@.......0..............@..@.data.......0......................@....pdata..d...........................@..@.crthunk.....P......................@..@.gxfg....-...`......................@..@.retplne.................................tls....Z...........................@...CPADinfo8...........................@..._RDATA..\...........................@..@.rsrc...`...........................@..@.reloc..t...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-92994.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1074347
                                                                                                                                                                                                                                                      Entropy (8bit):7.950213533603012
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7991781431FDA2F1630FC5206F77D4DC
                                                                                                                                                                                                                                                      SHA1:D5AF71EA1CC106329C7F2758D92669FEA9284FE5
                                                                                                                                                                                                                                                      SHA-256:2389F9EBB821637603E2CDAC2A6FE04ADF71AB90D796B9A60D6E551AA907D78C
                                                                                                                                                                                                                                                      SHA-512:D0A661A4D8B155CAD981122B77E5AFD6250FBA734F296E851800EDA36622D3E3C002E425BB66E6F1B7A459AE3755971E59FC91CD74956AC53DB9EAAADB672261
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..........P.........)...........z.....!.........p?....q?>...r?....s?*...t?....u?....v?z...w?...x?P...y?...z?%...{?....|?...}?T...~?.....?.....?.....?.....?G....?.....??....?.....?.....?.....?|....?b....?.%...?.C...?.Y...?tn...?Op...?.p...?@r...?.y...?Pz...?.|...?.~...?S....?.....?V....?....?.....?.....?.....?.....?.....?V....?.....?.....?.....?e....?.....?(....?~....?.8...?oF...?.H...?.J...?.M...?.U...?.]...?gl...?.|...?.....?S....?....?y....?.....?.....?.....?.....?.....?.+...?.:...?JN...?,b...?.y...?U....?....?.....?.....?.....?.....?V!...?.9...?.H...?.`...?.c...?....?m....?....?.....?.....?x....?.....?.+...?/G...?.Y...?....?l....?2....?....?%....?.....?.....?.....?.....?W$...?.9...?.E...?.O...?UV...?.^...?.f...?al...?.w...?3....?.....?.....?....?r....?.....?@....?.@...?.a...?\....@.....@K....@T....@.....@.5...@.c...@E....@.....@.....@Y....@.....@.....@g6...@.....@.....@$....@.....@.....@2...&@....'@....(@(...)@....*@"...+@....,@....-@`....@1!../@n+..0@....1@....2@|...5@..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-A7FDS.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):225
                                                                                                                                                                                                                                                      Entropy (8bit):4.8117977927405695
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:941DCF61AC29C9DA9F37D833FC6D27B5
                                                                                                                                                                                                                                                      SHA1:6F99668DB8EF0B37C97A6BA3095F965454785AD5
                                                                                                                                                                                                                                                      SHA-256:7EB68EA50A5373F9A5E6E72B2FD000565E6B21B1E545161BE91CDC233F18B98B
                                                                                                                                                                                                                                                      SHA-512:1E03DC56CC639555F38F7E262A1A24F7045B7E0937249ADAA42C72AE4E7C89076E85DF85ADB8BB79E08AED527841A4D848A8D087756B1600F153143CC5203701
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='122.10.0.1101'.. version='122.10.0.1101'.. type='win32'/>.. <file name='shift_elf.dll'/>..</assembly>..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-ACQJB.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1294336
                                                                                                                                                                                                                                                      Entropy (8bit):6.231860930640466
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:472CE5F53F89EACFD327A14245945A36
                                                                                                                                                                                                                                                      SHA1:215DAE06ED5EA69157472B298D596AF5AD85365B
                                                                                                                                                                                                                                                      SHA-256:292381D3A7C72378806669A64075A9B044099E02A01F1765E35EF8D1AF11BED8
                                                                                                                                                                                                                                                      SHA-512:FA0C019D2232577BFB2D44CC91654AB78F4CD6AF20A673E4F92D98053B083C193D76B2B6FC551B29FB78F6F1161AD9CB1E1FB2D022406BB5940E8286A9F28A2A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."......:...n......@>.........@..........................................`..........................................T..[...sT...........&.......p..................lI......................PH..(....a..@...........`Z..8............................text...F8.......:.................. ..`.rdata.......P.......>..............@..@.data...xx..........................@....pdata...p.......r..................@..@.gxfg....*.......,...>..............@..@.retplne.....0.......j...................tls....b....@.......l..............@...LZMADEC......P.......n.............. ..`_RDATA..\....p......................@..@.rsrc....&.......(..................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-AP095.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                                                                                      Entropy (8bit):7.610063770240452
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7EFD6E7860C734F637CDF39F5198DE0C
                                                                                                                                                                                                                                                      SHA1:2C70FF826D21D8953660D20577A70D169A14BACA
                                                                                                                                                                                                                                                      SHA-256:8AF583B76C5B208D3AA55BBABF164949CA0786537CCEBF57AFA3CC5B0CC82CE0
                                                                                                                                                                                                                                                      SHA-512:130A4266A41175190801B08CC851D9BED43EE35E90B9D9309EFC427E8FE41F971D54F1D82AF2A308CBB1792BCDE21436D0DE01CDFE685A8DDBC24CAADCE6CF4F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....0...0................_..H.?..;.0...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...191126212310Z..291123212310Z0..1.0...U....CA1.0...U....British Columbia1.0...U....Victoria1.0...U....Shift1.0...U....Client1.0...U....tryshift.com1$0"..*.H........shiftdev@tryshift.com0.."0...*.H.............0.........8;.i.W.......S..n./..ja......GE..l.J.|..~......t[m..ru....u.x.$X'...+....+;.#...K...u.......p....b....,....}k3..XAJ.?....)...uV...E...5=.@..@....~.r..}. .."5...Z@.1..c.../w........A.'..]......3de4........s....}.roM..$qU.R..>......e..o"(T.a......o0m0...U......j.Wgr....].5.Aa ..n0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...*.H............._.+....+..@...<.....v.K..)...X.......|\.-}..jf.x..8.@.D..Y\I....y.:..+.......,DBQo....t&.-U.Q....T...(.'...tw+]........e..^.C|y..S....@N.7=O.u.w.N.V..AN......K.m..MV.#2/Q.......r.{.x..``cj.Z'.B

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EISFN.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):214837104
                                                                                                                                                                                                                                                      Entropy (8bit):6.6576399745316595
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:013147C71B586AC0ACF9550274CA4BEC
                                                                                                                                                                                                                                                      SHA1:A19F16CE737880F95BEEDC1B3034AEF852CCF667
                                                                                                                                                                                                                                                      SHA-256:E5B2A33A058CDA25958A1B44A0E9CFA803FC94C0ED6D32E34167822205EB55F1
                                                                                                                                                                                                                                                      SHA-512:89F0550048C097FAD0BBADD005B1D11E8FE0255E3D93302F033FFEEC1C776025047328534D91E15BF89CF865A9C258E63729D4167C520029A6C717DEF764C2DC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .........J................................................)...........`A..........................................[.....Y.[.h.......8....`..(rG.....p............3N.8....................,N.(.......@.............[......B[.`....................text............................... ..`.rdata..h.|.......|.................@..@.data...P.f..P`......0`.............@....pdata..(rG..`...tG..@k.............@..@.gxfg....B.......D..................@..@.retplne.....0...........................rodata......@...................... ..`.tls.........`......................@...CPADinfo8....p......................@...LZMADEC............................. ..`_RDATA..\............&..............@..@malloc_hV............(.............. ..`.rsrc...8...........................@..@.reloc.............................@..B........................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-EUCDG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4916728
                                                                                                                                                                                                                                                      Entropy (8bit):6.397948646164362
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:03A60A6652CAF4F49EA5912CE4E1B33C
                                                                                                                                                                                                                                                      SHA1:A0D949D4AF7B1048DC55E39D1D1260A1E0660C4F
                                                                                                                                                                                                                                                      SHA-256:B23E7B820ED5C6EA7DCD77817E2CD79F1CEC9561D457172287EE634A8BD658C3
                                                                                                                                                                                                                                                      SHA-512:6711D40D171EA200C92D062226A69F33EB41E9232D74291EF6F0202DE73CF4DC54FBDD769104D2BB3E89DC2D81F2F2F3479E4258A5D6A54C545E56B07746B4C4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...;............." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J......PJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-FMBJ2.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):679161
                                                                                                                                                                                                                                                      Entropy (8bit):5.217317760174776
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:88AE59F86C9F25FC4DF4BBCC2C8BB686
                                                                                                                                                                                                                                                      SHA1:4210AC3AC2AF7F634E33BF50F73D02690E8FF9B6
                                                                                                                                                                                                                                                      SHA-256:0F321E2C998619EDAB0857FB336C122C088864AC3C08C63C74678E2894C548DE
                                                                                                                                                                                                                                                      SHA-512:1EFECA6E60026D7E4E5C32501C6CD83AC9BCDB1689D0AC9F548E95BD20931B45177F6CD949C62CFA18714463FB0E3653C975F950BC30F9A3F5FFBD748DAF2AB7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.......... .....12.2.281.19.............................................................................$...x...a........a........a........ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-G1855.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):920064
                                                                                                                                                                                                                                                      Entropy (8bit):6.590744072045023
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:812631AE92F3EA931514EEC349D07CB5
                                                                                                                                                                                                                                                      SHA1:3AAC3CA97DA919BDE6951247BF922910BF0F5FB1
                                                                                                                                                                                                                                                      SHA-256:65369E9C55C5532D84B64A25F6A2DAEF19D4D8138691ACF0101FF904158533CA
                                                                                                                                                                                                                                                      SHA-512:AA8EEEDB7086C69C9956D00CA225F798AA7A29C757AC8F67C0560C6979D7CB149988A988FEA7A09E36645361BD972F603EB1E23C35ECCDC7909792F2D3D5D261
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .....2..........PH....................................................`A............................................<!......P................r..................<...8................... ...(....P..@............................................text...[1.......2.................. ..`.rdata.......P.......6..............@..@.data...@L...P..."...2..............@....pdata...r.......t...T..............@..@.gxfg...P)... ...*..................@..@.retplne.....P...........................tls.........`......................@..._RDATA..\....p......................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-IU081.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):452096
                                                                                                                                                                                                                                                      Entropy (8bit):6.343422139738044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A34C06043A5E168A1A2AF6F22353CB84
                                                                                                                                                                                                                                                      SHA1:C6AC09CB4A9A3D934D8EA5BC7E2F467C8E0CC850
                                                                                                                                                                                                                                                      SHA-256:334E28F7611F2F9268639B836565C59D73C1B4CCD08EEF6D6A6D5DBBCB8C4EAD
                                                                                                                                                                                                                                                      SHA-512:24D9DD33CC22A265641454422FB7CBE870415EB68A7B9D0452EBE8EEB6F4B2C99C28AD01A10E59B28EC88B9ACBDAB4202D44434022D416D34426B9B352C023D1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .................'....................................................`A........................................X...h.......(....`..`........@...........p..H...L...8...................0...(.......@............................................text............................... ..`.rdata...z.......|..................@..@.data...tK...`... ...B..............@....pdata...@.......B...b..............@..@.gxfg... &.......(..................@..@.retplne.....0...........................tls....!....@......................@..._RDATA..\....P......................@..@.rsrc...`....`......................@..@.reloc..H....p......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-KAIME.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1567232
                                                                                                                                                                                                                                                      Entropy (8bit):6.452251853553107
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:268E8E565EA15D6BF8281955CF87D68B
                                                                                                                                                                                                                                                      SHA1:1142DA87952072DA12B11E9DFBC219869A4FF0EA
                                                                                                                                                                                                                                                      SHA-256:917E8FE9B006E36DFFAA45AF660254361FD17593A90CD8C666C557AF5E4DC774
                                                                                                                                                                                                                                                      SHA-512:33611A6024F1FC4B806912801E7F880D1BB8182C39FF9415CB65C03D6111DB476F04009B8BB1323A1CFB95EFA48A4F5D3C8D59D7863188B84A806F29E8D21463
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ................@.....................................................`A........................................pM..p....M.......................................;..8....................:..(.......@............T...............................text............................... ..`.rdata..l...........................@..@.data..............................@....pdata..............................@..@.gxfg....*...p...,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-MVLTH.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4346880
                                                                                                                                                                                                                                                      Entropy (8bit):6.296179683691982
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1B859F3D8E7762FFFABFE5624254EB05
                                                                                                                                                                                                                                                      SHA1:370AB2A8357E162B5822D79CE29178EBCA4C75B4
                                                                                                                                                                                                                                                      SHA-256:966D662AC0ECC064B1BC433824DA378C541BDFAAF6748F24A2A84216D6730712
                                                                                                                                                                                                                                                      SHA-512:6CAE187C1EA58576078CA28F3F4188C4618EDC6D7AFFF1128FF5B08EF1A71C428112A3A8AA0AC42289F0B096FC61178889DDE9E462E3E8F89E04EF29B5AF9E17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ......2..4......`.........................................C...........`A..........................................=.....p.=.P....`C.......A..q...........pC..g....=.8.....................=.(....02.@.............=.8............................text.....2.......2................. ..`.rdata..t....02.......2.............@..@.data.........>.......>.............@....pdata...q....A..r...@@.............@..@.gxfg....-....C.......A.............@..@.retplne.....0C.......A..................tls....Y....@C.......A.............@..._RDATA..\....PC.......A.............@..@.rsrc........`C.......A.............@..@.reloc...g...pC..h....A.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-NH3GK.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1177600
                                                                                                                                                                                                                                                      Entropy (8bit):6.416906322786882
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:97122835FF3ECF428FA312952B038A02
                                                                                                                                                                                                                                                      SHA1:2368F0F8A50E58393E1895183E128460CE9AFEA2
                                                                                                                                                                                                                                                      SHA-256:B4F9326ACED72BCD001E5A9EECA6626D45494361A6B5BA3188B9536DE812B211
                                                                                                                                                                                                                                                      SHA-512:A0E41B2D59D91BA0F67F3A6FDB5AEF55326BAEC60BF4A788B9A21ECA5CA0DC6EA4F0A4BBCFF103BED23CF2F80B17120617CD8684B159CE8FBF9A5157AC8DFB5E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."......F..........0..........@..........................................`............................................\...$........... .......T...............d..............................(....q..@........... ................................text...fD.......F.................. ..`.rdata.......`.......J..............@..@.data...8....P.......,..............@....pdata..T...........................@..@.gxfg...@-...p......................@..@.retplne.................................tls....q...........................@...CPADinfo8...........................@..._RDATA..\...........................@..@.rsrc... ...........................@..@.reloc..d...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-SK5J3.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):106
                                                                                                                                                                                                                                                      Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                      SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                      SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                      SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\is-UJ3TQ.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8245174
                                                                                                                                                                                                                                                      Entropy (8bit):7.997377709451082
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7D3F42FA9FDD93D4BE08FA3907BF736C
                                                                                                                                                                                                                                                      SHA1:020F863964B60D06C0A1159B0094B9A1B016E7BE
                                                                                                                                                                                                                                                      SHA-256:8EFA6B26EE18706C7D4202DFBC10B4665447B35ED51B1193E1DECA3B76D8BB49
                                                                                                                                                                                                                                                      SHA-512:99A954A5D74C957701FEB9272CD34F63244685323DA125DEEFABA7339F898E013297C99A12477C75CB32B04AABCC15853E0FA6817306D64D55F397E7403F9FFC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............f.2<..{..F..|..I..~..M....._.....a................d.....>.....2...........S.....z%.....&....sA.....D....[F.....G....hP....~Q.....S....aT....?U....wV.....Y................B................e..........Q...........b....?L....?....-?c....?-.../?...0?r...1?....2?....3??...4?....5?....6?.%..7?Q<..8?SQ..9?Rd..:?.s..;?....<?...=?....>?....??....@?....A?....B?.-..C?\F..D?.Z..E?Xr..F?\...G?...t@....u@...v@{...w@....x@....y@....~@.....@.....@.....AN....A^....A.....A.....Ay....A"....A.....A%....Ao...<A. ..=A.1..>A.B..?A.C..@A.G..AA.J..BA.P..CA.V..DA._...A.e...A2h...A&o...A.}...Au~...A.....A.....A.....Ay....A....A.....A....Aq....Ax....A.....A.....A.....A.....A.....A}....A.....A....A.....A}....A.....A.....A&....A.....A.....AT....Ae....A.....B.....B.....B.....BM....B.....B.....B|....B@...,B....-BW....B.....DB$...D.&...D.(...D.)...D{,...D|/...DJ0...D.2...D.3..>I&7..?IB8..@IB=..AI]?..BI.@..CI.B..DI.E..EI~H..RI.J..wI.U..xI._..yI.k..zI.w..{IV....I)....I(....I6....I.....IP....I,....I..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libEGL.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):452096
                                                                                                                                                                                                                                                      Entropy (8bit):6.343422139738044
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A34C06043A5E168A1A2AF6F22353CB84
                                                                                                                                                                                                                                                      SHA1:C6AC09CB4A9A3D934D8EA5BC7E2F467C8E0CC850
                                                                                                                                                                                                                                                      SHA-256:334E28F7611F2F9268639B836565C59D73C1B4CCD08EEF6D6A6D5DBBCB8C4EAD
                                                                                                                                                                                                                                                      SHA-512:24D9DD33CC22A265641454422FB7CBE870415EB68A7B9D0452EBE8EEB6F4B2C99C28AD01A10E59B28EC88B9ACBDAB4202D44434022D416D34426B9B352C023D1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .................'....................................................`A........................................X...h.......(....`..`........@...........p..H...L...8...................0...(.......@............................................text............................... ..`.rdata...z.......|..................@..@.data...tK...`... ...B..............@....pdata...@.......B...b..............@..@.gxfg... &.......(..................@..@.retplne.....0...........................tls....!....@......................@..._RDATA..\....P......................@..@.rsrc...`....`......................@..@.reloc..H....p......................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\libGLESv2.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):7799296
                                                                                                                                                                                                                                                      Entropy (8bit):6.446718189372986
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C241BA50FDB83039FBFBD51DD2101302
                                                                                                                                                                                                                                                      SHA1:FC9C567A60A78A40FFC80C9ABD26D3E3D9B54556
                                                                                                                                                                                                                                                      SHA-256:0CB748C53CC721F248B649AB33512F0ADA3F2237633C01D35633C48545E5849A
                                                                                                                                                                                                                                                      SHA-512:96F3C7C914FBB7E9E439B3F54E6590B3ED523546DC1D47D9D1DCD47D3909E82A660286D3BB6AD93904FD03D983CF9A56768F8AACC24728EA63A6110945793C74
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ......Z..:.......}W.......................................w...........`A.........................................}n.....H[o.d.....w......Pt.$O............w.....<.n.8.....................n.(.....Z.@...........@`o......|n.@....................text.....Z.......Z................. ..`.rdata..DO....Z..P....Z.............@..@.data...\....0p.......p.............@....pdata..$O...Pt..P....s.............@..@.gxfg....,....v.......u.............@..@.retplne......v......$v..................tls....B.....v......&v.............@..._RDATA..\.....v......(v.............@..@.rsrc.........w......*v.............@..@.reloc........w......0v.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\mojo_core.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1567232
                                                                                                                                                                                                                                                      Entropy (8bit):6.452251853553107
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:268E8E565EA15D6BF8281955CF87D68B
                                                                                                                                                                                                                                                      SHA1:1142DA87952072DA12B11E9DFBC219869A4FF0EA
                                                                                                                                                                                                                                                      SHA-256:917E8FE9B006E36DFFAA45AF660254361FD17593A90CD8C666C557AF5E4DC774
                                                                                                                                                                                                                                                      SHA-512:33611A6024F1FC4B806912801E7F880D1BB8182C39FF9415CB65C03D6111DB476F04009B8BB1323A1CFB95EFA48A4F5D3C8D59D7863188B84A806F29E8D21463
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ................@.....................................................`A........................................pM..p....M.......................................;..8....................:..(.......@............T...............................text............................... ..`.rdata..l...........................@..@.data..............................@....pdata..............................@..@.gxfg....*...p...,..................@..@.retplne.................................tls................................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\notification_helper.exe (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1177600
                                                                                                                                                                                                                                                      Entropy (8bit):6.416906322786882
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:97122835FF3ECF428FA312952B038A02
                                                                                                                                                                                                                                                      SHA1:2368F0F8A50E58393E1895183E128460CE9AFEA2
                                                                                                                                                                                                                                                      SHA-256:B4F9326ACED72BCD001E5A9EECA6626D45494361A6B5BA3188B9536DE812B211
                                                                                                                                                                                                                                                      SHA-512:A0E41B2D59D91BA0F67F3A6FDB5AEF55326BAEC60BF4A788B9A21ECA5CA0DC6EA4F0A4BBCFF103BED23CF2F80B17120617CD8684B159CE8FBF9A5157AC8DFB5E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."......F..........0..........@..........................................`............................................\...$........... .......T...............d..............................(....q..@........... ................................text...fD.......F.................. ..`.rdata.......`.......J..............@..@.data...8....P.......,..............@....pdata..T...........................@..@.gxfg...@-...p......................@..@.retplne.................................tls....q...........................@...CPADinfo8...........................@..._RDATA..\...........................@..@.rsrc... ...........................@..@.reloc..d...........................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8245174
                                                                                                                                                                                                                                                      Entropy (8bit):7.997377709451082
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7D3F42FA9FDD93D4BE08FA3907BF736C
                                                                                                                                                                                                                                                      SHA1:020F863964B60D06C0A1159B0094B9A1B016E7BE
                                                                                                                                                                                                                                                      SHA-256:8EFA6B26EE18706C7D4202DFBC10B4665447B35ED51B1193E1DECA3B76D8BB49
                                                                                                                                                                                                                                                      SHA-512:99A954A5D74C957701FEB9272CD34F63244685323DA125DEEFABA7339F898E013297C99A12477C75CB32B04AABCC15853E0FA6817306D64D55F397E7403F9FFC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............f.2<..{..F..|..I..~..M....._.....a................d.....>.....2...........S.....z%.....&....sA.....D....[F.....G....hP....~Q.....S....aT....?U....wV.....Y................B................e..........Q...........b....?L....?....-?c....?-.../?...0?r...1?....2?....3??...4?....5?....6?.%..7?Q<..8?SQ..9?Rd..:?.s..;?....<?...=?....>?....??....@?....A?....B?.-..C?\F..D?.Z..E?Xr..F?\...G?...t@....u@...v@{...w@....x@....y@....~@.....@.....@.....AN....A^....A.....A.....Ay....A"....A.....A%....Ao...<A. ..=A.1..>A.B..?A.C..@A.G..AA.J..BA.P..CA.V..DA._...A.e...A2h...A&o...A.}...Au~...A.....A.....A.....Ay....A....A.....A....Aq....Ax....A.....A.....A.....A.....A.....A}....A.....A....A.....A}....A.....A.....A&....A.....A.....AT....Ae....A.....B.....B.....B.....BM....B.....B.....B|....B@...,B....-BW....B.....DB$...D.&...D.(...D.)...D{,...D|/...DJ0...D.2...D.3..>I&7..?IB8..@IB=..AI]?..BI.@..CI.B..DI.E..EI~H..RI.J..wI.U..xI._..yI.k..zI.w..{IV....I)....I(....I6....I.....IP....I,....I..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\inspector_overlay\inspector_overlay_resources.grd (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):532
                                                                                                                                                                                                                                                      Entropy (8bit):4.912769861588248
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E6229A8D1ECC4D9D6B49DC2986624285
                                                                                                                                                                                                                                                      SHA1:0CAA0BDF14BE3C3E74ABEBA57D31A3DD0D58EB5E
                                                                                                                                                                                                                                                      SHA-256:68760FC7002C3999D3B2AC6EB80FEBE28182134A0DD1D53829F660B3D96BC9EF
                                                                                                                                                                                                                                                      SHA-512:764C3636877086DC5D30A7539AB01CD2D87979B5E0E34B5216F99F63BCF5B9AC216631525BD2A960F063F325820262D616053E36A8FFDD3BE67543B5D33963B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<grit latest_public_release="0" current_release="1" output_all_resource_defines="false">. <outputs>. <output filename="grit/inspector_overlay_resources_map.h" type="rc_header">. <emit emit_type="prepend"></emit>. </output>. <output filename="inspector_overlay_resources.pak" type="data_package" />. </outputs>. <release seq="1">. <includes>. <include name="IDR_INSPECT_TOOL_MAIN_JS" file="main.js" type="BINDATA" compress="gzip"/>. </includes>. </release>.</grit>.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\inspector_overlay\is-1EI8V.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):532
                                                                                                                                                                                                                                                      Entropy (8bit):4.912769861588248
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E6229A8D1ECC4D9D6B49DC2986624285
                                                                                                                                                                                                                                                      SHA1:0CAA0BDF14BE3C3E74ABEBA57D31A3DD0D58EB5E
                                                                                                                                                                                                                                                      SHA-256:68760FC7002C3999D3B2AC6EB80FEBE28182134A0DD1D53829F660B3D96BC9EF
                                                                                                                                                                                                                                                      SHA-512:764C3636877086DC5D30A7539AB01CD2D87979B5E0E34B5216F99F63BCF5B9AC216631525BD2A960F063F325820262D616053E36A8FFDD3BE67543B5D33963B0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<grit latest_public_release="0" current_release="1" output_all_resource_defines="false">. <outputs>. <output filename="grit/inspector_overlay_resources_map.h" type="rc_header">. <emit emit_type="prepend"></emit>. </output>. <output filename="inspector_overlay_resources.pak" type="data_package" />. </outputs>. <release seq="1">. <includes>. <include name="IDR_INSPECT_TOOL_MAIN_JS" file="main.js" type="BINDATA" compress="gzip"/>. </includes>. </release>.</grit>.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\inspector_overlay\is-TLKNO.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):79025
                                                                                                                                                                                                                                                      Entropy (8bit):5.5565557853108105
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D56D65AD5DA1ECEF27F0F6EA637C670A
                                                                                                                                                                                                                                                      SHA1:9C37A3BB74534859C25026F764C84FA6FA3C84D4
                                                                                                                                                                                                                                                      SHA-256:18B8D5596B4BAF474E84926AC832C6303EB9CECF6BF8C08F63D8E7AD077CAC2A
                                                                                                                                                                                                                                                      SHA-512:F241CB9B672B212CF04DD0A6D666FAEF902C1E8013925DFED2CED76A8DA7026439A63079A57A0E838E36FFD1A37C6CF478043C98F9C141EB9AB40485E9E7EC8B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:!function(){"use strict";const t=new CSSStyleSheet;t.replaceSync('/*\n * Copyright 2019 The Chromium Authors. All rights reserved.\n * Use of this source code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\nbody {\n margin: 0;\n padding: 0;\n font-size: 13px;\n color: #222;\n}\n\nbody.platform-linux {\n font-family: Roboto, Ubuntu, Arial, sans-serif;\n}\n\nbody.platform-mac {\n color: rgb(48 57 66);\n font-family: ".SFNSDisplay-Regular", "Helvetica Neue", "Lucida Grande", sans-serif;\n}\n\nbody.platform-windows {\n font-family: "Segoe UI", Tahoma, sans-serif;\n}\n\n.fill {\n position: absolute;\n top: 0;\n right: 0;\n bottom: 0;\n left: 0;\n}\n\n#canvas {\n pointer-events: none;\n}\n\n.hidden {\n display: none !important; /* stylelint-disable-line declaration-no-important */\n}\n');class n{viewportSize={width:800,height:600};viewportSizeForMediaQueries;deviceScaleFactor=1;emulationScaleFactor=1;pageScaleFactor=1;pageZoomFactor=1;scro

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\inspector_overlay\main.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 text, with very long lines (65532), with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):79025
                                                                                                                                                                                                                                                      Entropy (8bit):5.5565557853108105
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D56D65AD5DA1ECEF27F0F6EA637C670A
                                                                                                                                                                                                                                                      SHA1:9C37A3BB74534859C25026F764C84FA6FA3C84D4
                                                                                                                                                                                                                                                      SHA-256:18B8D5596B4BAF474E84926AC832C6303EB9CECF6BF8C08F63D8E7AD077CAC2A
                                                                                                                                                                                                                                                      SHA-512:F241CB9B672B212CF04DD0A6D666FAEF902C1E8013925DFED2CED76A8DA7026439A63079A57A0E838E36FFD1A37C6CF478043C98F9C141EB9AB40485E9E7EC8B
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:!function(){"use strict";const t=new CSSStyleSheet;t.replaceSync('/*\n * Copyright 2019 The Chromium Authors. All rights reserved.\n * Use of this source code is governed by a BSD-style license that can be\n * found in the LICENSE file.\n */\n\nbody {\n margin: 0;\n padding: 0;\n font-size: 13px;\n color: #222;\n}\n\nbody.platform-linux {\n font-family: Roboto, Ubuntu, Arial, sans-serif;\n}\n\nbody.platform-mac {\n color: rgb(48 57 66);\n font-family: ".SFNSDisplay-Regular", "Helvetica Neue", "Lucida Grande", sans-serif;\n}\n\nbody.platform-windows {\n font-family: "Segoe UI", Tahoma, sans-serif;\n}\n\n.fill {\n position: absolute;\n top: 0;\n right: 0;\n bottom: 0;\n left: 0;\n}\n\n#canvas {\n pointer-events: none;\n}\n\n.hidden {\n display: none !important; /* stylelint-disable-line declaration-no-important */\n}\n');class n{viewportSize={width:800,height:600};viewportSizeForMediaQueries;deviceScaleFactor=1;emulationScaleFactor=1;pageScaleFactor=1;pageZoomFactor=1;scro

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\app-types.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):880672
                                                                                                                                                                                                                                                      Entropy (8bit):4.863172134464401
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:18244E700977C7428F38DC5DADEC51C7
                                                                                                                                                                                                                                                      SHA1:15A10EA84A6487B9BB4A3C5C156E2EE8DA2147D6
                                                                                                                                                                                                                                                      SHA-256:C2407022B6B1A20580CB7988FC94305F18D90878AFFBE4D15497385CECAE51F4
                                                                                                                                                                                                                                                      SHA-512:E807874182F46B482189FF04F5FE4673A2686D50361BFC118B9FEEAA61E2071F6C1834DB156BC287F58710522AF98C57C28A952AFCCF8BDF5C0E8949E55F938F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[{"name":"PrestaShop","description":"PrestaShop is a ready-made solution to create and manage your online business.","category":"E-Commerce and Shopping","disallow_webview_muting":false,"url":{"urls":["https://auth.prestashop.com/login"],"has_prefix":false,"allow_custom_path":false},"id":"prestashop","image_url":"https://apps.tryshiftcdn.com/prestashop/image.svg","color_image_url":"https://apps.tryshiftcdn.com/prestashop/image-color.svg","monochrome_image_url":"https://apps.tryshiftcdn.com/prestashop/image-monochrome.svg"},{"name":"SocialBee","description":"SocialBee is an AI-powered social media management tool that provides you with the tools to create engaging content effortlessly.","category":"Marketing and Analytics","url":{"urls":["https://app.socialbee.com/"]},"id":"socialbee","image_url":"https://apps.tryshiftcdn.com/socialbee/image.svg","color_image_url":"https://apps.tryshiftcdn.com/socialbee/image-color.svg","monochrome_image_url":"https://apps.tryshiftcdn.com/socialbee/imag

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\assets\browser-Us5ffC9p.css (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1196929
                                                                                                                                                                                                                                                      Entropy (8bit):5.231958162435012
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:51EBA8E3E940191DA3A089D49F3526CA
                                                                                                                                                                                                                                                      SHA1:12008AE7AB4B389155F821F2B78F7F188FE3F148
                                                                                                                                                                                                                                                      SHA-256:45ECD75DFBFB598AFC3AC9BA02CE5462B8A4799087533B997D7D0F203BF31568
                                                                                                                                                                                                                                                      SHA-512:11AE615C4FD3CAF95D4EF3ABAB23459E12D69F368324AE157ADDEB0AABC4F69A7927719B849FE4102404D72781853EF6A08944F89216AC6F6D11B7A22A59EF7C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.icon-button{--icon-button-size-small: 24px;--icon-button-size-medium: 32px;--icon-button-size-large: 36px;--icon-button-icon-size-small: 12px;--icon-button-icon-size-medium: 16px;--icon-button-icon-size-large: 24px;--icon-button-size: var(--icon-button-size-small);--icon-button-icon-size: var(--icon-button-icon-size-small);--icon-button-background-default: var(--surface-buttons-icon-default);--icon-button-background-hover: var(--surface-buttons-icon-hover);--icon-button-background-active: var(--surface-buttons-icon-active);--icon-button-text-default: var(--text-iconbutton-default);--icon-button-text-hover: var(--text-iconbutton-hover);--icon-button-text-active: var(--text-iconbutton-active);--icon-button-text-focus: var(--text-iconbutton-default);--icon-button-text-disabled: var(--text-iconbutton-notselected);--icon-button-border-focus: var(--border-focus-secondary);--icon-button-border-focus-inner: var(--color-basic-white);--icon-button-border-radius: var(--radius-md);--icon-button-b

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\assets\hydrateStore-DmGfJwXx.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (18915)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):575599
                                                                                                                                                                                                                                                      Entropy (8bit):5.392006212247865
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9D45D1A68257175614BEC028B9E4F395
                                                                                                                                                                                                                                                      SHA1:D07081A290950C147D64A1F736BED73DCA78F343
                                                                                                                                                                                                                                                      SHA-256:A36216CC55CC98690A05010FC1ACF0B0E1382B042948AB0EAD9948AC3AB148A1
                                                                                                                                                                                                                                                      SHA-512:AA9C282DA9A783E1E6D72D70AD5F4C001AF3A44B57586E7D5890E4935ABC7338E0AB8743568E3B31F540B1C6393A1BB2D0490DE80E93D804F0974753B3CDC0D0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var $A=Object.defineProperty;var s=(e,t)=>$A(e,"name",{value:t,configurable:!0});(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="4452d9ef-1f0d-4e98-8dd1-8ce3e8bee91a",e._sentryDebugIdIdentifier="sentry-dbid-4452d9ef-1f0d-4e98-8dd1-8ce3e8bee91a")}catch{}})();var FA=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};FA.SENTRY_RELEASE={id:"122.10.0"};var Hi=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function jA(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}s(jA,"getDefaultExportFromCjs");var Dv={exports:{}},De={};/**. * @license React. * react.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\assets\is-RQTUO.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (18915)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):575599
                                                                                                                                                                                                                                                      Entropy (8bit):5.392006212247865
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9D45D1A68257175614BEC028B9E4F395
                                                                                                                                                                                                                                                      SHA1:D07081A290950C147D64A1F736BED73DCA78F343
                                                                                                                                                                                                                                                      SHA-256:A36216CC55CC98690A05010FC1ACF0B0E1382B042948AB0EAD9948AC3AB148A1
                                                                                                                                                                                                                                                      SHA-512:AA9C282DA9A783E1E6D72D70AD5F4C001AF3A44B57586E7D5890E4935ABC7338E0AB8743568E3B31F540B1C6393A1BB2D0490DE80E93D804F0974753B3CDC0D0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var $A=Object.defineProperty;var s=(e,t)=>$A(e,"name",{value:t,configurable:!0});(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="4452d9ef-1f0d-4e98-8dd1-8ce3e8bee91a",e._sentryDebugIdIdentifier="sentry-dbid-4452d9ef-1f0d-4e98-8dd1-8ce3e8bee91a")}catch{}})();var FA=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};FA.SENTRY_RELEASE={id:"122.10.0"};var Hi=typeof globalThis<"u"?globalThis:typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{};function jA(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}s(jA,"getDefaultExportFromCjs");var Dv={exports:{}},De={};/**. * @license React. * react.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\assets\is-VUQTV.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1196929
                                                                                                                                                                                                                                                      Entropy (8bit):5.231958162435012
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:51EBA8E3E940191DA3A089D49F3526CA
                                                                                                                                                                                                                                                      SHA1:12008AE7AB4B389155F821F2B78F7F188FE3F148
                                                                                                                                                                                                                                                      SHA-256:45ECD75DFBFB598AFC3AC9BA02CE5462B8A4799087533B997D7D0F203BF31568
                                                                                                                                                                                                                                                      SHA-512:11AE615C4FD3CAF95D4EF3ABAB23459E12D69F368324AE157ADDEB0AABC4F69A7927719B849FE4102404D72781853EF6A08944F89216AC6F6D11B7A22A59EF7C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.icon-button{--icon-button-size-small: 24px;--icon-button-size-medium: 32px;--icon-button-size-large: 36px;--icon-button-icon-size-small: 12px;--icon-button-icon-size-medium: 16px;--icon-button-icon-size-large: 24px;--icon-button-size: var(--icon-button-size-small);--icon-button-icon-size: var(--icon-button-icon-size-small);--icon-button-background-default: var(--surface-buttons-icon-default);--icon-button-background-hover: var(--surface-buttons-icon-hover);--icon-button-background-active: var(--surface-buttons-icon-active);--icon-button-text-default: var(--text-iconbutton-default);--icon-button-text-hover: var(--text-iconbutton-hover);--icon-button-text-active: var(--text-iconbutton-active);--icon-button-text-focus: var(--text-iconbutton-default);--icon-button-text-disabled: var(--text-iconbutton-notselected);--icon-button-border-focus: var(--border-focus-secondary);--icon-button-border-focus-inner: var(--color-basic-white);--icon-button-border-radius: var(--radius-md);--icon-button-b

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\browser.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (39466)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):706087
                                                                                                                                                                                                                                                      Entropy (8bit):5.440205698878474
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3210BE0145DC0167E77DB638658F112D
                                                                                                                                                                                                                                                      SHA1:16DAB2F022679117823DB6105B487AD0897D689C
                                                                                                                                                                                                                                                      SHA-256:C1E4CE9671F49FED3C1E9C70E44C02C10642DF246C68E7C622F053DFB582AADE
                                                                                                                                                                                                                                                      SHA-512:4E0F5D109F44E2C1C84F7C8112B25320A6ADD7B1D5191A1675960F7F6D69DD376BC6CD69099262784B28E44E1FB820C900517F30997A68DC6073668348A11B6A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var oT=Object.defineProperty;var i=(e,t)=>oT(e,"name",{value:t,configurable:!0});import{r as m,g as $u,a as iT,b as sT,c as aT,d as lT,e as _w,l as ho,f as Eo,i as we,S as Ie,E as ao,L as st,z as Ne,h as uT,M as Du,j as ta,s as Mt,k as zt,m as yt,n as cT,o as dT,R as q,p as fT,q as Xh,C as hT,u as Fr,B as Mu,t as $t,v as pT,w as Fw,x as gT,y as Bw,N as Ja,W as Vw,A as zw,D as mT,F as vT,G as yT,H as wT,I as bT,J as xT,K as ST,O as ET,P as el,Q as Qh,T as om,U as Mc,V as fr,X as CT,Y as PT}from"./assets/hydrateStore-DmGfJwXx.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="4ef252d5-ffe0-4e10-8a5d-38b92c3a8bf9",e._sentryDebugIdIdentifier="sentry-dbid-4ef252d5-ffe0-4e10-8a5d-38b92c3a8bf9")}catch{}})();var Uw={exports:{}},Iu={};/**. * @license React. * react-jsx-runtime.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This so

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\folder-mini.svg (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):810
                                                                                                                                                                                                                                                      Entropy (8bit):4.87373629690593
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CC160EFF6BF2654D893D5A04FE37BDF4
                                                                                                                                                                                                                                                      SHA1:78FA2AA60C812328416C0657398F037BA29ABC5F
                                                                                                                                                                                                                                                      SHA-256:D09077E84B52B4E74D48E2E876766A8CA2DDD73A75E5D9AEEDF813A0C6F1A90F
                                                                                                                                                                                                                                                      SHA-512:E11D0D02F65A1935CA3B3DC507A1E36FAA868F45E3C26BC34617AC0CC5BCD6FEC0FFA5277D2E78F516BBF4A60D37B59BE2E41427A9210C841F5554591026FA5D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <g clip-path="url(#clip0_5_3268)">. <path. d="M15.25 13.25V5.75C15.25 4.64543 14.3546 3.75 13.25 3.75H0.75V13.25C0.75 14.3546 1.64543 15.25 2.75 15.25H13.25C14.3546 15.25 15.25 14.3546 15.25 13.25Z". stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />. <path. d="M9.5 3.5L8.5685 1.7923C8.2181 1.14977 7.5446 0.75 6.8127 0.75H2.75C1.64543 0.75 0.75 1.64543 0.75 2.75V7". stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />. </g>. <defs>. <clipPath id="clip0_5_3268">. <rect width="16" height="16" fill="white" />. </clipPath>. </defs>.</svg>

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\index.html (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):766
                                                                                                                                                                                                                                                      Entropy (8bit):4.787370493329659
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:249512EB474ED674695A54815C81D1B9
                                                                                                                                                                                                                                                      SHA1:BC1AE1001F7990E076305980EAC5DC48DF9328CF
                                                                                                                                                                                                                                                      SHA-256:7DC31B5BC583CF8922C859DF67A19747D50E1A00569E45ABB929DA3E1E2C4040
                                                                                                                                                                                                                                                      SHA-512:58B84B8DBFD21D0A6F78BDB7FEACE152DC9DA810248BDF0E44B9B2D0B6F4D24ABDB99C9B69B484F0F9CE71321BB3167D2A69D99718A8FC3ECD0138BF0EAB8441
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<!doctype html>.<html class="light windows">. <head>. <meta charset="UTF-8" />. <title>Shift</title>. <style>. html.light {. background-color: #d1d5db;. }.. html.dark {. background-color: #262626;. }. </style>. <script type="module" crossorigin src="/browser.js"></script>. <link rel="modulepreload" crossorigin href="/assets/hydrateStore-DmGfJwXx.js">. <link rel="stylesheet" crossorigin href="/assets/browser-Us5ffC9p.css">. </head>. <body>. <div id="app"></div>.. Popovers and dialogs render here -->. <div id="portal"></div>.. Window controls render here to avoid conflicts with drag regions, z-indexes or overlays -->. <div id="window-controls-portal"></div>.. </body>.</html>.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\injection\ChromeWebStore.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1077
                                                                                                                                                                                                                                                      Entropy (8bit):4.86359819175057
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:07181D97AF8EC371BA2DABB1F6FEFC1C
                                                                                                                                                                                                                                                      SHA1:05A32431D2ADAAE7146D6EDDFA6EF4D2A2090136
                                                                                                                                                                                                                                                      SHA-256:0BD0527DF8F1359CC49E6E47B02229885587EC51ADDE754B72013B5A3271E810
                                                                                                                                                                                                                                                      SHA-512:8FA3D72B22E11FE53DB275AD9E488F6212AEFF96A6A880C6283A9674B7B9C8FB83A02DBDC145DF96480B92D4D31573C1F5105823BBA6B12F31FAF6605490A399
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:const CHROME_ADD_BUTTON_TEXT = 'Add to Chrome'.const CHROME_REMOVE_BUTTON_TEXT = 'Remove from Chrome'.const SHIFT_ADD_BUTTON_TEXT = 'Add to Shift'.const SHIFT_REMOVE_BUTTON_TEXT = 'Remove from Shift'..class ChromeWebStore {. constructor() {. this.start(). }.. start() {. try {. const observer = new MutationObserver(() => {. const addButtonElement = Array.from(document.querySelectorAll('span')).find(. element => element.innerText === CHROME_ADD_BUTTON_TEXT. ). if (addButtonElement) addButtonElement.innerText = SHIFT_ADD_BUTTON_TEXT.. const removeButtonElement = Array.from(document.querySelectorAll('span')).find(. element => element.innerText === CHROME_REMOVE_BUTTON_TEXT. ).. if (removeButtonElement) removeButtonElement.innerText = SHIFT_REMOVE_BUTTON_TEXT. }).. observer.observe(document.body, {. childList: true,. subtree: true. }). } catch (error) {. chrome.runtime.sendMessage(

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\injection\IntegratedAppStorage.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2000
                                                                                                                                                                                                                                                      Entropy (8bit):4.6455778594096095
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6AF8E7B58FDB30696F3F789DA4B0E8BE
                                                                                                                                                                                                                                                      SHA1:D2701AC9F1DD8CE656E49F6C56805A3CA569DEB6
                                                                                                                                                                                                                                                      SHA-256:F021CEC789124F8EEEC820CCB59E81F376D161ADE960F9978C887E9B57E4141B
                                                                                                                                                                                                                                                      SHA-512:71990B196BE64BBF95D3FA32FD48B1896DB2329AD983EC3049C9D48510D01D6CCEEAC658C7DB1F69E5A74BC2D3AE744462B38A3CC759670AA959759C1C34EA26
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:const SYNC_STORAGE_KEY = 'sync.'..class IntegratedAppStorage {. constructor({ webUiAppData }) {. this.webUiAppData = webUiAppData. this.start(). }.. start() {. try {. // Listen for changes from the app's local storage and update the Web UI storage. window.addEventListener('storage:local-change', event => {. const { detail } = event.. if (!detail.key.startsWith(SYNC_STORAGE_KEY)) return.. chrome.runtime.sendMessage({. channel: 'integrated-app-storage',. body: { storageItem: detail }. }). }).. const isWebUiDataEmpty = Object.keys(this.webUiAppData).length === 0. const syncLocalStorage = Object.entries(window.localStorage).filter(([key]) =>. key.startsWith(SYNC_STORAGE_KEY). ). const isSyncLocalStorageEmpty = syncLocalStorage.length === 0.. // Pull the app's sync local storage into the Web UI storage if needed for the first time. if (isWebUiDataEmpty && !isSyncLocalStorageEmpty) {

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\injection\UnreadObserver.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4593
                                                                                                                                                                                                                                                      Entropy (8bit):4.626012712312796
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3025E0D58F9989AA4E9A8D7ED6198AC1
                                                                                                                                                                                                                                                      SHA1:96E67E2727C6CF503E2B41EED246453E7CDAB4A5
                                                                                                                                                                                                                                                      SHA-256:322C716660C5ED09DC93EF5C9EADA1C4D6DBDDB2AB07A9964DF31477581DAB37
                                                                                                                                                                                                                                                      SHA-512:2061A46EC43D235986D29317981EBA3E6C6B9E3B8070FEEA9A05584B25516084F7425720FC66ABEFA41D450466BB436200F506B4DD576B00A3987BA24152E4ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:class UnreadObserver {. UPDATE_DELAY_MS = 500 // 0.5s. SETUP_INTERVAL_MS = 30 * 1000 // 30s.. constructor({ config, extractorFunction }) {. this.config = config. this.extractorFunction = extractorFunction. this.countTimeout = null. this.lastUnread = null. this.observedNodes = new WeakSet().. if (!config) {. throw new Error('Cannot observe unread count without an extractor config'). }.. this.start(). }.. start() {. // Don't run in iframes. if (window.parent !== window) return.. // Setup observer now, again on-load, and periodically thereafter. this.setupObserver(). window.addEventListener('load', () => this.setupObserver()). setInterval(() => this.setupObserver(), this.SETUP_INTERVAL_MS). }.. setupObserver() {. // Find the node to observe for mutations. const node = document.querySelector(this.config.observerSelector).. if (!node) return.. // If the observer is already setup on this node, nothing to do. if (this.observ

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\injection\is-0UFT2.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2000
                                                                                                                                                                                                                                                      Entropy (8bit):4.6455778594096095
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6AF8E7B58FDB30696F3F789DA4B0E8BE
                                                                                                                                                                                                                                                      SHA1:D2701AC9F1DD8CE656E49F6C56805A3CA569DEB6
                                                                                                                                                                                                                                                      SHA-256:F021CEC789124F8EEEC820CCB59E81F376D161ADE960F9978C887E9B57E4141B
                                                                                                                                                                                                                                                      SHA-512:71990B196BE64BBF95D3FA32FD48B1896DB2329AD983EC3049C9D48510D01D6CCEEAC658C7DB1F69E5A74BC2D3AE744462B38A3CC759670AA959759C1C34EA26
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:const SYNC_STORAGE_KEY = 'sync.'..class IntegratedAppStorage {. constructor({ webUiAppData }) {. this.webUiAppData = webUiAppData. this.start(). }.. start() {. try {. // Listen for changes from the app's local storage and update the Web UI storage. window.addEventListener('storage:local-change', event => {. const { detail } = event.. if (!detail.key.startsWith(SYNC_STORAGE_KEY)) return.. chrome.runtime.sendMessage({. channel: 'integrated-app-storage',. body: { storageItem: detail }. }). }).. const isWebUiDataEmpty = Object.keys(this.webUiAppData).length === 0. const syncLocalStorage = Object.entries(window.localStorage).filter(([key]) =>. key.startsWith(SYNC_STORAGE_KEY). ). const isSyncLocalStorageEmpty = syncLocalStorage.length === 0.. // Pull the app's sync local storage into the Web UI storage if needed for the first time. if (isWebUiDataEmpty && !isSyncLocalStorageEmpty) {

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\injection\is-8JEEU.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1077
                                                                                                                                                                                                                                                      Entropy (8bit):4.86359819175057
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:07181D97AF8EC371BA2DABB1F6FEFC1C
                                                                                                                                                                                                                                                      SHA1:05A32431D2ADAAE7146D6EDDFA6EF4D2A2090136
                                                                                                                                                                                                                                                      SHA-256:0BD0527DF8F1359CC49E6E47B02229885587EC51ADDE754B72013B5A3271E810
                                                                                                                                                                                                                                                      SHA-512:8FA3D72B22E11FE53DB275AD9E488F6212AEFF96A6A880C6283A9674B7B9C8FB83A02DBDC145DF96480B92D4D31573C1F5105823BBA6B12F31FAF6605490A399
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:const CHROME_ADD_BUTTON_TEXT = 'Add to Chrome'.const CHROME_REMOVE_BUTTON_TEXT = 'Remove from Chrome'.const SHIFT_ADD_BUTTON_TEXT = 'Add to Shift'.const SHIFT_REMOVE_BUTTON_TEXT = 'Remove from Shift'..class ChromeWebStore {. constructor() {. this.start(). }.. start() {. try {. const observer = new MutationObserver(() => {. const addButtonElement = Array.from(document.querySelectorAll('span')).find(. element => element.innerText === CHROME_ADD_BUTTON_TEXT. ). if (addButtonElement) addButtonElement.innerText = SHIFT_ADD_BUTTON_TEXT.. const removeButtonElement = Array.from(document.querySelectorAll('span')).find(. element => element.innerText === CHROME_REMOVE_BUTTON_TEXT. ).. if (removeButtonElement) removeButtonElement.innerText = SHIFT_REMOVE_BUTTON_TEXT. }).. observer.observe(document.body, {. childList: true,. subtree: true. }). } catch (error) {. chrome.runtime.sendMessage(

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\injection\is-LD9M0.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:C++ source, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4593
                                                                                                                                                                                                                                                      Entropy (8bit):4.626012712312796
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3025E0D58F9989AA4E9A8D7ED6198AC1
                                                                                                                                                                                                                                                      SHA1:96E67E2727C6CF503E2B41EED246453E7CDAB4A5
                                                                                                                                                                                                                                                      SHA-256:322C716660C5ED09DC93EF5C9EADA1C4D6DBDDB2AB07A9964DF31477581DAB37
                                                                                                                                                                                                                                                      SHA-512:2061A46EC43D235986D29317981EBA3E6C6B9E3B8070FEEA9A05584B25516084F7425720FC66ABEFA41D450466BB436200F506B4DD576B00A3987BA24152E4ED
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:class UnreadObserver {. UPDATE_DELAY_MS = 500 // 0.5s. SETUP_INTERVAL_MS = 30 * 1000 // 30s.. constructor({ config, extractorFunction }) {. this.config = config. this.extractorFunction = extractorFunction. this.countTimeout = null. this.lastUnread = null. this.observedNodes = new WeakSet().. if (!config) {. throw new Error('Cannot observe unread count without an extractor config'). }.. this.start(). }.. start() {. // Don't run in iframes. if (window.parent !== window) return.. // Setup observer now, again on-load, and periodically thereafter. this.setupObserver(). window.addEventListener('load', () => this.setupObserver()). setInterval(() => this.setupObserver(), this.SETUP_INTERVAL_MS). }.. setupObserver() {. // Find the node to observe for mutations. const node = document.querySelector(this.config.observerSelector).. if (!node) return.. // If the observer is already setup on this node, nothing to do. if (this.observ

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\is-7A7B0.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (3442)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3486
                                                                                                                                                                                                                                                      Entropy (8bit):5.239804781134579
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:70E5151A1B5265CD5EDE6DAAE893F224
                                                                                                                                                                                                                                                      SHA1:061CCCA411C249C2F0A5FD4E75463A82E3C76FC6
                                                                                                                                                                                                                                                      SHA-256:0F53329EF7FE58915FED9CE1D6D6A51079A04DD31AFD090AA213BB3EE2E761BE
                                                                                                                                                                                                                                                      SHA-512:32D0157AB58F81A62B9498400B0C7812AC8343C05EEECF1967F66DD3C06DD1647522E74B1489BDB396081B1C3C91AC8884ECC9D70E0DC349F6A985C34C4BED00
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var S=Object.defineProperty;var s=(e,t)=>S(e,"name",{value:t,configurable:!0});import{f as u,L as l,z as y,t as w,i as d,S as T,Z as F,j as b,a as L,b as C,c as D,d as E,Y as R,_ as v}from"./assets/hydrateStore-DmGfJwXx.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="c90a698c-3d21-47ca-a21b-7aeb54879ef1",e._sentryDebugIdIdentifier="sentry-dbid-c90a698c-3d21-47ca-a21b-7aeb54879ef1")}catch{}})();const x=1e4,I="normal";function h(){const e=u(),t=new l(h);return new Promise((i,o)=>{let r=!1,a;const c=s(n=>{clearTimeout(a),r||(r=!0,i(n))},"clearResolve"),f=s(n=>{clearTimeout(a),r||(r=!0,o(n))},"clearReject"),p=s(n=>{n.type===I&&(e.windows.onCreated.removeListener(p),c(n))},"onWindowCreated");e.windows.onCreated.addListener(p),e.windows.getAll({windowTypes:[I]},n=>{if(n.length>0){const[g]=n;if(!g){f(new Error("No window found"));return}e.windows.onCreated.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\is-HJI4V.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):766
                                                                                                                                                                                                                                                      Entropy (8bit):4.787370493329659
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:249512EB474ED674695A54815C81D1B9
                                                                                                                                                                                                                                                      SHA1:BC1AE1001F7990E076305980EAC5DC48DF9328CF
                                                                                                                                                                                                                                                      SHA-256:7DC31B5BC583CF8922C859DF67A19747D50E1A00569E45ABB929DA3E1E2C4040
                                                                                                                                                                                                                                                      SHA-512:58B84B8DBFD21D0A6F78BDB7FEACE152DC9DA810248BDF0E44B9B2D0B6F4D24ABDB99C9B69B484F0F9CE71321BB3167D2A69D99718A8FC3ECD0138BF0EAB8441
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<!doctype html>.<html class="light windows">. <head>. <meta charset="UTF-8" />. <title>Shift</title>. <style>. html.light {. background-color: #d1d5db;. }.. html.dark {. background-color: #262626;. }. </style>. <script type="module" crossorigin src="/browser.js"></script>. <link rel="modulepreload" crossorigin href="/assets/hydrateStore-DmGfJwXx.js">. <link rel="stylesheet" crossorigin href="/assets/browser-Us5ffC9p.css">. </head>. <body>. <div id="app"></div>.. Popovers and dialogs render here -->. <div id="portal"></div>.. Window controls render here to avoid conflicts with drag regions, z-indexes or overlays -->. <div id="window-controls-portal"></div>.. </body>.</html>.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\is-IJGIA.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (39466)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):706087
                                                                                                                                                                                                                                                      Entropy (8bit):5.440205698878474
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3210BE0145DC0167E77DB638658F112D
                                                                                                                                                                                                                                                      SHA1:16DAB2F022679117823DB6105B487AD0897D689C
                                                                                                                                                                                                                                                      SHA-256:C1E4CE9671F49FED3C1E9C70E44C02C10642DF246C68E7C622F053DFB582AADE
                                                                                                                                                                                                                                                      SHA-512:4E0F5D109F44E2C1C84F7C8112B25320A6ADD7B1D5191A1675960F7F6D69DD376BC6CD69099262784B28E44E1FB820C900517F30997A68DC6073668348A11B6A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var oT=Object.defineProperty;var i=(e,t)=>oT(e,"name",{value:t,configurable:!0});import{r as m,g as $u,a as iT,b as sT,c as aT,d as lT,e as _w,l as ho,f as Eo,i as we,S as Ie,E as ao,L as st,z as Ne,h as uT,M as Du,j as ta,s as Mt,k as zt,m as yt,n as cT,o as dT,R as q,p as fT,q as Xh,C as hT,u as Fr,B as Mu,t as $t,v as pT,w as Fw,x as gT,y as Bw,N as Ja,W as Vw,A as zw,D as mT,F as vT,G as yT,H as wT,I as bT,J as xT,K as ST,O as ET,P as el,Q as Qh,T as om,U as Mc,V as fr,X as CT,Y as PT}from"./assets/hydrateStore-DmGfJwXx.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="4ef252d5-ffe0-4e10-8a5d-38b92c3a8bf9",e._sentryDebugIdIdentifier="sentry-dbid-4ef252d5-ffe0-4e10-8a5d-38b92c3a8bf9")}catch{}})();var Uw={exports:{}},Iu={};/**. * @license React. * react-jsx-runtime.production.min.js. *. * Copyright (c) Facebook, Inc. and its affiliates.. *. * This so

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\is-KNFQF.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4386
                                                                                                                                                                                                                                                      Entropy (8bit):5.022016088254076
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:086C9D8C73DAD20C8E0CEABDC893C309
                                                                                                                                                                                                                                                      SHA1:A7E3BAE94800E43C4AC6763029FC77DF2BA114D0
                                                                                                                                                                                                                                                      SHA-256:1910F0F4ACFE551CFCF6924D57B150538905073AF612C8946C00A78A3C8ADCC7
                                                                                                                                                                                                                                                      SHA-512:DC3B428A0B1E0804910371D3BE0469CC79FBE1A05F3D9DFE58F6F8491D2E1D6EADC7D63CA97E10FA164ADC7BF64F2DD5F52346F551A3E750017C2D0FC8536FCE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<svg xmlns:xlink="http://www.w3.org/1999/xlink" width="32" height="32" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M74.9775 74.9775C-24.9925 174.948 -24.9925 337.038 74.9775 437.018C174.948 536.988 337.037 536.988 437.017 437.018L74.9775 74.9775Z" fill="url(#paint0_linear_318_13)"/>.<path d="M437.018 74.9775C337.048 -24.9925 174.958 -24.9925 74.9775 74.9775L437.018 437.017C536.988 337.047 536.988 174.958 437.018 74.9775Z" fill="url(#paint1_linear_318_13)"/>.<path d="M437.018 437.018C487.008 387.028 487.008 305.988 437.018 255.998L346.508 165.488C337.718 156.698 327.968 149.468 317.598 143.768C308.508 138.778 298.948 134.968 289.138 132.348C246.438 120.948 198.988 131.988 165.488 165.488L346.508 346.508C381.448 381.448 383.828 436.598 353.668 474.298C351.458 477.068 349.068 479.738 346.508 482.308C338.578 490.238 329.608 496.478 320.038 501.058C311.828 504.978 303.188 507.678 294.378 509.138C303.868 507.708 313.178 505.758 322.298 503.318C366.348 491.5

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\is-PNALV.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):880672
                                                                                                                                                                                                                                                      Entropy (8bit):4.863172134464401
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:18244E700977C7428F38DC5DADEC51C7
                                                                                                                                                                                                                                                      SHA1:15A10EA84A6487B9BB4A3C5C156E2EE8DA2147D6
                                                                                                                                                                                                                                                      SHA-256:C2407022B6B1A20580CB7988FC94305F18D90878AFFBE4D15497385CECAE51F4
                                                                                                                                                                                                                                                      SHA-512:E807874182F46B482189FF04F5FE4673A2686D50361BFC118B9FEEAA61E2071F6C1834DB156BC287F58710522AF98C57C28A952AFCCF8BDF5C0E8949E55F938F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[{"name":"PrestaShop","description":"PrestaShop is a ready-made solution to create and manage your online business.","category":"E-Commerce and Shopping","disallow_webview_muting":false,"url":{"urls":["https://auth.prestashop.com/login"],"has_prefix":false,"allow_custom_path":false},"id":"prestashop","image_url":"https://apps.tryshiftcdn.com/prestashop/image.svg","color_image_url":"https://apps.tryshiftcdn.com/prestashop/image-color.svg","monochrome_image_url":"https://apps.tryshiftcdn.com/prestashop/image-monochrome.svg"},{"name":"SocialBee","description":"SocialBee is an AI-powered social media management tool that provides you with the tools to create engaging content effortlessly.","category":"Marketing and Analytics","url":{"urls":["https://app.socialbee.com/"]},"id":"socialbee","image_url":"https://apps.tryshiftcdn.com/socialbee/image.svg","color_image_url":"https://apps.tryshiftcdn.com/socialbee/image-color.svg","monochrome_image_url":"https://apps.tryshiftcdn.com/socialbee/imag

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\is-VGEQ7.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):810
                                                                                                                                                                                                                                                      Entropy (8bit):4.87373629690593
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:CC160EFF6BF2654D893D5A04FE37BDF4
                                                                                                                                                                                                                                                      SHA1:78FA2AA60C812328416C0657398F037BA29ABC5F
                                                                                                                                                                                                                                                      SHA-256:D09077E84B52B4E74D48E2E876766A8CA2DDD73A75E5D9AEEDF813A0C6F1A90F
                                                                                                                                                                                                                                                      SHA-512:E11D0D02F65A1935CA3B3DC507A1E36FAA868F45E3C26BC34617AC0CC5BCD6FEC0FFA5277D2E78F516BBF4A60D37B59BE2E41427A9210C841F5554591026FA5D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">. <g clip-path="url(#clip0_5_3268)">. <path. d="M15.25 13.25V5.75C15.25 4.64543 14.3546 3.75 13.25 3.75H0.75V13.25C0.75 14.3546 1.64543 15.25 2.75 15.25H13.25C14.3546 15.25 15.25 14.3546 15.25 13.25Z". stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />. <path. d="M9.5 3.5L8.5685 1.7923C8.2181 1.14977 7.5446 0.75 6.8127 0.75H2.75C1.64543 0.75 0.75 1.64543 0.75 2.75V7". stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" />. </g>. <defs>. <clipPath id="clip0_5_3268">. <rect width="16" height="16" fill="white" />. </clipPath>. </defs>.</svg>

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\service-worker.js (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (3442)
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3486
                                                                                                                                                                                                                                                      Entropy (8bit):5.239804781134579
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:70E5151A1B5265CD5EDE6DAAE893F224
                                                                                                                                                                                                                                                      SHA1:061CCCA411C249C2F0A5FD4E75463A82E3C76FC6
                                                                                                                                                                                                                                                      SHA-256:0F53329EF7FE58915FED9CE1D6D6A51079A04DD31AFD090AA213BB3EE2E761BE
                                                                                                                                                                                                                                                      SHA-512:32D0157AB58F81A62B9498400B0C7812AC8343C05EEECF1967F66DD3C06DD1647522E74B1489BDB396081B1C3C91AC8884ECC9D70E0DC349F6A985C34C4BED00
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:var S=Object.defineProperty;var s=(e,t)=>S(e,"name",{value:t,configurable:!0});import{f as u,L as l,z as y,t as w,i as d,S as T,Z as F,j as b,a as L,b as C,c as D,d as E,Y as R,_ as v}from"./assets/hydrateStore-DmGfJwXx.js";(function(){try{var e=typeof window<"u"?window:typeof global<"u"?global:typeof self<"u"?self:{},t=new Error().stack;t&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[t]="c90a698c-3d21-47ca-a21b-7aeb54879ef1",e._sentryDebugIdIdentifier="sentry-dbid-c90a698c-3d21-47ca-a21b-7aeb54879ef1")}catch{}})();const x=1e4,I="normal";function h(){const e=u(),t=new l(h);return new Promise((i,o)=>{let r=!1,a;const c=s(n=>{clearTimeout(a),r||(r=!0,i(n))},"clearResolve"),f=s(n=>{clearTimeout(a),r||(r=!0,o(n))},"clearReject"),p=s(n=>{n.type===I&&(e.windows.onCreated.removeListener(p),c(n))},"onWindowCreated");e.windows.onCreated.addListener(p),e.windows.getAll({windowTypes:[I]},n=>{if(n.length>0){const[g]=n;if(!g){f(new Error("No window found"));return}e.windows.onCreated.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\resources\wexond\shift-logo.svg (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4386
                                                                                                                                                                                                                                                      Entropy (8bit):5.022016088254076
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:086C9D8C73DAD20C8E0CEABDC893C309
                                                                                                                                                                                                                                                      SHA1:A7E3BAE94800E43C4AC6763029FC77DF2BA114D0
                                                                                                                                                                                                                                                      SHA-256:1910F0F4ACFE551CFCF6924D57B150538905073AF612C8946C00A78A3C8ADCC7
                                                                                                                                                                                                                                                      SHA-512:DC3B428A0B1E0804910371D3BE0469CC79FBE1A05F3D9DFE58F6F8491D2E1D6EADC7D63CA97E10FA164ADC7BF64F2DD5F52346F551A3E750017C2D0FC8536FCE
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:<svg xmlns:xlink="http://www.w3.org/1999/xlink" width="32" height="32" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">.<path d="M74.9775 74.9775C-24.9925 174.948 -24.9925 337.038 74.9775 437.018C174.948 536.988 337.037 536.988 437.017 437.018L74.9775 74.9775Z" fill="url(#paint0_linear_318_13)"/>.<path d="M437.018 74.9775C337.048 -24.9925 174.958 -24.9925 74.9775 74.9775L437.018 437.017C536.988 337.047 536.988 174.958 437.018 74.9775Z" fill="url(#paint1_linear_318_13)"/>.<path d="M437.018 437.018C487.008 387.028 487.008 305.988 437.018 255.998L346.508 165.488C337.718 156.698 327.968 149.468 317.598 143.768C308.508 138.778 298.948 134.968 289.138 132.348C246.438 120.948 198.988 131.988 165.488 165.488L346.508 346.508C381.448 381.448 383.828 436.598 353.668 474.298C351.458 477.068 349.068 479.738 346.508 482.308C338.578 490.238 329.608 496.478 320.038 501.058C311.828 504.978 303.188 507.678 294.378 509.138C303.868 507.708 313.178 505.758 322.298 503.318C366.348 491.5

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2823680
                                                                                                                                                                                                                                                      Entropy (8bit):6.395970585855767
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1D06621473A8216A98687546A595EC5D
                                                                                                                                                                                                                                                      SHA1:17672FD58998115E09D03BDF78574F44D30D99B7
                                                                                                                                                                                                                                                      SHA-256:5F125E8C60E15716E14F2A6B9E57F1088245A1F4547CCEB505835A7736027F29
                                                                                                                                                                                                                                                      SHA-512:8FD7DE0C2B7E22C7729ABBD2611FA5D4C68E4908827A6919ED059D0498DB7CB992A087B31DEC5A690281A9B0E03FC5EC5C2DF64C3B45EC11A3C5CC6F5B4BB0DF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........."....... ..R.................@.............................p,...........`..........................................M$.N...DN$.T.....(.......'..............@,..!..|3$.....................P2$.(..... .@...........`[$.....hM$.@....................text...%. ....... ................. ..`.rdata...~.... ....... .............@..@.data.......@%......0%.............@....pdata........'......$&.............@..@.gxfg...p0....(..2....'.............@..@.retplne.....@(......H'..................tls.........P(......J'.............@...CPADinfo8....`(......L'.............@...LZMADEC......p(......N'............. ..`_RDATA..\.....(......`'.............@..@.rsrc.........(......b'.............@..@.reloc...!...@,.."....*.............@..B........................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):214837104
                                                                                                                                                                                                                                                      Entropy (8bit):6.6576399745316595
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:013147C71B586AC0ACF9550274CA4BEC
                                                                                                                                                                                                                                                      SHA1:A19F16CE737880F95BEEDC1B3034AEF852CCF667
                                                                                                                                                                                                                                                      SHA-256:E5B2A33A058CDA25958A1B44A0E9CFA803FC94C0ED6D32E34167822205EB55F1
                                                                                                                                                                                                                                                      SHA-512:89F0550048C097FAD0BBADD005B1D11E8FE0255E3D93302F033FFEEC1C776025047328534D91E15BF89CF865A9C258E63729D4167C520029A6C717DEF764C2DC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .........J................................................)...........`A..........................................[.....Y.[.h.......8....`..(rG.....p............3N.8....................,N.(.......@.............[......B[.`....................text............................... ..`.rdata..h.|.......|.................@..@.data...P.f..P`......0`.............@....pdata..(rG..`...tG..@k.............@..@.gxfg....B.......D..................@..@.retplne.....0...........................rodata......@...................... ..`.tls.........`......................@...CPADinfo8....p......................@...LZMADEC............................. ..`_RDATA..\............&..............@..@malloc_hV............(.............. ..`.rsrc...8...........................@..@.reloc.............................@..B........................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift.dll.sig (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                                                                                      Entropy (8bit):7.600081069916784
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2D705C7AE5FC217935DC1D8113AFCDD8
                                                                                                                                                                                                                                                      SHA1:655B27F73E379CB6A4B2B6D7BE6C6590A494F47D
                                                                                                                                                                                                                                                      SHA-256:CDABF04991763A53E7BCF7C2E83CF8DB50B2F79AD659254081C1CE2CE489FDC4
                                                                                                                                                                                                                                                      SHA-512:63024BCFC87718FCD1E70AAA8A5540C1BF97A71E2FFB04631C4479E13CB1C0DEF695B71AE3362B1BCAF49533949F917444EF839D38643A2A939F5E9A5AD912EF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....0...0................_..H.?..;.0...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...191126212310Z..291123212310Z0..1.0...U....CA1.0...U....British Columbia1.0...U....Victoria1.0...U....Shift1.0...U....Client1.0...U....tryshift.com1$0"..*.H........shiftdev@tryshift.com0.."0...*.H.............0.........8;.i.W.......S..n./..ja......GE..l.J.|..~......t[m..ru....u.x.$X'...+....+;.#...K...u.......p....b....,....}k3..XAJ.?....)...uV...E...5=.@..@....~.r..}. .."5...Z@.1..c.../w........A.'..]......3de4........s....}.roM..$qU.R..>......e..o"(T.a......o0m0...U......j.Wgr....].5.Aa ..n0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...*.H............._.+....+..@...<.....v.K..)...X.......|\.-}..jf.x..8.@.D..Y\I....y.:..+.......,DBQo....t&.-U.Q....T...(.'...tw+]........e..^.C|y..S....@N.7=O.u.w.N.V..AN......K.m..MV.#2/Q.......r.{.x..``cj.Z'.B

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift.exe.sig (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1439
                                                                                                                                                                                                                                                      Entropy (8bit):7.610063770240452
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7EFD6E7860C734F637CDF39F5198DE0C
                                                                                                                                                                                                                                                      SHA1:2C70FF826D21D8953660D20577A70D169A14BACA
                                                                                                                                                                                                                                                      SHA-256:8AF583B76C5B208D3AA55BBABF164949CA0786537CCEBF57AFA3CC5B0CC82CE0
                                                                                                                                                                                                                                                      SHA-512:130A4266A41175190801B08CC851D9BED43EE35E90B9D9309EFC427E8FE41F971D54F1D82AF2A308CBB1792BCDE21436D0DE01CDFE685A8DDBC24CAADCE6CF4F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:....0...0................_..H.?..;.0...*.H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...191126212310Z..291123212310Z0..1.0...U....CA1.0...U....British Columbia1.0...U....Victoria1.0...U....Shift1.0...U....Client1.0...U....tryshift.com1$0"..*.H........shiftdev@tryshift.com0.."0...*.H.............0.........8;.i.W.......S..n./..ja......GE..l.J.|..~......t[m..ru....u.x.$X'...+....+;.#...K...u.......p....b....,....}k3..XAJ.?....)...uV...E...5=.@..@....~.r..}. .."5...Z@.1..c.../w........A.'..]......3de4........s....}.roM..$qU.R..>......e..o"(T.a......o0m0...U......j.Wgr....].5.Aa ..n0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...*.H............._.+....+..@...<.....v.K..)...X.......|\.-}..jf.x..8.@.D..Y\I....y.:..+.......,DBQo....t&.-U.Q....T...(.'...tw+]........e..^.C|y..S....@N.7=O.u.w.N.V..AN......K.m..MV.#2/Q.......r.{.x..``cj.Z'.B

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_100_percent.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):686086
                                                                                                                                                                                                                                                      Entropy (8bit):7.963084561349391
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6BE00EC0C6F3C4B249A298BBE108576C
                                                                                                                                                                                                                                                      SHA1:823B17A2B2261BDBBD6ECCF0D5C98F11A28BE17C
                                                                                                                                                                                                                                                      SHA-256:289768986318853074605544E8D64476C23BCD21B5841D48D6E387936A091933
                                                                                                                                                                                                                                                      SHA-512:FE84BF6D9EB29D8501CA50D486BD36AE7235653747BEE004EF9C89E025CA9FE707284683ADFEC04C81BE9F5E08DF857180AB9549BA6F260057EA2F672425A9A5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..........Q...........................<.........p?....q?d...r?...s?8...t?....u?....v?d...w?...x?"...y?....z?...{?5...|?....}?...~?J....?.....?.....?F....?.....?y....?.....?....?-....?K....?.....?.....?.....?.....?!....?.....?.....?.....?.....?.....?i....?1....?.....?.....?.....?,....?.....?.....?a....?.....?q....?.&...?:'...?.'...?.(...?C)...?.)...?.2...?.<...?.P...?.c...?.q...?.r...?)u...?.x...?[....?.....?S....?....?.....?....?{....?....?Z....?}....?.....?.....?.....?d....?.....?.....?.....?$....?S....?.....?.....?.....?1#...?.+...?.3...?.9...?.A...?*C...?.a...?.z...?.....?.....?.....?_....?.....?.....?.%...?.8...?.a...?.v...?....?r....?.....?{....?.....?.....?:....?.....?.....?(#...?.-...?d4...?.<...?.D...?LJ...?.U...?.`...?.d...?.h...?.m...?/....?_....?.....?.....?.....?w....@.....@.....@A....@.....@.+...@.A...@KS...@.d...@.r...@.|...@.....@.....@.....@l....@.....@.....@.....@.....@f...&@....'@....(@Z...)@q...*@;...+@M...,@k...-@.....@(.../@....0@[9..1@S;..2@:>..5@.B..6@.I

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_200_percent.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1074347
                                                                                                                                                                                                                                                      Entropy (8bit):7.950213533603012
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7991781431FDA2F1630FC5206F77D4DC
                                                                                                                                                                                                                                                      SHA1:D5AF71EA1CC106329C7F2758D92669FEA9284FE5
                                                                                                                                                                                                                                                      SHA-256:2389F9EBB821637603E2CDAC2A6FE04ADF71AB90D796B9A60D6E551AA907D78C
                                                                                                                                                                                                                                                      SHA-512:D0A661A4D8B155CAD981122B77E5AFD6250FBA734F296E851800EDA36622D3E3C002E425BB66E6F1B7A459AE3755971E59FC91CD74956AC53DB9EAAADB672261
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:..........P.........)...........z.....!.........p?....q?>...r?....s?*...t?....u?....v?z...w?...x?P...y?...z?%...{?....|?...}?T...~?.....?.....?.....?.....?G....?.....??....?.....?.....?.....?|....?b....?.%...?.C...?.Y...?tn...?Op...?.p...?@r...?.y...?Pz...?.|...?.~...?S....?.....?V....?....?.....?.....?.....?.....?.....?V....?.....?.....?.....?e....?.....?(....?~....?.8...?oF...?.H...?.J...?.M...?.U...?.]...?gl...?.|...?.....?S....?....?y....?.....?.....?.....?.....?.....?.+...?.:...?JN...?,b...?.y...?U....?....?.....?.....?.....?.....?V!...?.9...?.H...?.`...?.c...?....?m....?....?.....?.....?x....?.....?.+...?/G...?.Y...?....?l....?2....?....?%....?.....?.....?.....?.....?W$...?.9...?.E...?.O...?UV...?.^...?.f...?al...?.w...?3....?.....?.....?....?r....?.....?@....?.@...?.a...?\....@.....@K....@T....@.....@.5...@.c...@E....@.....@.....@Y....@.....@.....@g6...@.....@.....@$....@.....@.....@2...&@....'@....(@(...)@....*@"...+@....,@....-@`....@1!../@n+..0@....1@....2@|...5@..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_elf.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1170944
                                                                                                                                                                                                                                                      Entropy (8bit):6.41515711083642
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FA873BA1DB4398F0B32BF77B6ACCBBB2
                                                                                                                                                                                                                                                      SHA1:A11F6B6673967FE4623F319457E2D096676470A9
                                                                                                                                                                                                                                                      SHA-256:64DC398C79FBEEFBFCA7403211E04D0A4613EBA0420AF32D6196B8DF56BA070F
                                                                                                                                                                                                                                                      SHA-512:E1CCE4F46ECAB0F73A58112F6B5DC9F89ED7C3B0B0DF417798297E78F9B2A4EAC1C62AF63FF6D2D25E293EA3CB45DF9612BE1115139E1231156570FC5965EFAF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .....,................................................................`A.........................................o......6s..P.......`.......d...............t....^..8....................]..(....@..@...........Hy......Pk.......................text....+.......,.................. ..`.rdata..$....@.......0..............@..@.data.......0......................@....pdata..d...........................@..@.crthunk.....P......................@..@.gxfg....-...`......................@..@.retplne.................................tls....Z...........................@...CPADinfo8...........................@..._RDATA..\...........................@..@.rsrc...`...........................@..@.reloc..t...........................@..B........................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_pwa_launcher.exe (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1294336
                                                                                                                                                                                                                                                      Entropy (8bit):6.231860930640466
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:472CE5F53F89EACFD327A14245945A36
                                                                                                                                                                                                                                                      SHA1:215DAE06ED5EA69157472B298D596AF5AD85365B
                                                                                                                                                                                                                                                      SHA-256:292381D3A7C72378806669A64075A9B044099E02A01F1765E35EF8D1AF11BED8
                                                                                                                                                                                                                                                      SHA-512:FA0C019D2232577BFB2D44CC91654AB78F4CD6AF20A673E4F92D98053B083C193D76B2B6FC551B29FB78F6F1161AD9CB1E1FB2D022406BB5940E8286A9F28A2A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."......:...n......@>.........@..........................................`..........................................T..[...sT...........&.......p..................lI......................PH..(....a..@...........`Z..8............................text...F8.......:.................. ..`.rdata.......P.......>..............@..@.data...xx..........................@....pdata...p.......r..................@..@.gxfg....*.......,...>..............@..@.retplne.....0.......j...................tls....b....@.......l..............@...LZMADEC......P.......n.............. ..`_RDATA..\....p......................@..@.rsrc....&.......(..................@..@.reloc..............................@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\shift_wer.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):113664
                                                                                                                                                                                                                                                      Entropy (8bit):5.875781821689646
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FE8297D5F009F9500F282BCF6CCCA307
                                                                                                                                                                                                                                                      SHA1:59C7E96CF242FD8B88D6DC3920BB37B590DB2DBB
                                                                                                                                                                                                                                                      SHA-256:18C11487549F5073D32DBD1214A96ED75113EB86200577ED879BA542A64AC54E
                                                                                                                                                                                                                                                      SHA-512:1703D90A10BCB9D8BC70500976AFDFEB6C2748A6D326A2817319728F92A9F0887054288DC2BC6D331A569B39DE1655B8E8CE5E8B14CE2C4E2978A4B7B7B804FC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ......................................................................`A.........................................o.......p..(...............................P...lm..8...............................@...........8s..x............................text...s........................... ..`.rdata..............................@..@.data................~..............@....pdata..............................@..@.gxfg...p...........................@..@.retplne................................_RDATA..\...........................@..@.rsrc...............................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\v8_context_snapshot.bin (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):679161
                                                                                                                                                                                                                                                      Entropy (8bit):5.217317760174776
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:88AE59F86C9F25FC4DF4BBCC2C8BB686
                                                                                                                                                                                                                                                      SHA1:4210AC3AC2AF7F634E33BF50F73D02690E8FF9B6
                                                                                                                                                                                                                                                      SHA-256:0F321E2C998619EDAB0857FB336C122C088864AC3C08C63C74678E2894C548DE
                                                                                                                                                                                                                                                      SHA-512:1EFECA6E60026D7E4E5C32501C6CD83AC9BCDB1689D0AC9F548E95BD20931B45177F6CD949C62CFA18714463FB0E3653C975F950BC30F9A3F5FFBD748DAF2AB7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.......... .....12.2.281.19.............................................................................$...x...a........a........a........ar.......a2.......aT.........."..............B..............b........."..............B........(Jb....L.....@..F^.-..1.`.....(Jb...2P.....@..F^..`.....H...IDa........Db............D`.....).D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L.................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vk_swiftshader.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4346880
                                                                                                                                                                                                                                                      Entropy (8bit):6.296179683691982
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1B859F3D8E7762FFFABFE5624254EB05
                                                                                                                                                                                                                                                      SHA1:370AB2A8357E162B5822D79CE29178EBCA4C75B4
                                                                                                                                                                                                                                                      SHA-256:966D662AC0ECC064B1BC433824DA378C541BDFAAF6748F24A2A84216D6730712
                                                                                                                                                                                                                                                      SHA-512:6CAE187C1EA58576078CA28F3F4188C4618EDC6D7AFFF1128FF5B08EF1A71C428112A3A8AA0AC42289F0B096FC61178889DDE9E462E3E8F89E04EF29B5AF9E17
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." ......2..4......`.........................................C...........`A..........................................=.....p.=.P....`C.......A..q...........pC..g....=.8.....................=.(....02.@.............=.8............................text.....2.......2................. ..`.rdata..t....02.......2.............@..@.data.........>.......>.............@....pdata...q....A..r...@@.............@..@.gxfg....-....C.......A.............@..@.retplne.....0C.......A..................tls....Y....@C.......A.............@..._RDATA..\....PC.......A.............@..@.rsrc........`C.......A.............@..@.reloc...g...pC..h....A.............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vk_swiftshader_icd.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):106
                                                                                                                                                                                                                                                      Entropy (8bit):4.724752649036734
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8642DD3A87E2DE6E991FAE08458E302B
                                                                                                                                                                                                                                                      SHA1:9C06735C31CEC00600FD763A92F8112D085BD12A
                                                                                                                                                                                                                                                      SHA-256:32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
                                                                                                                                                                                                                                                      SHA-512:F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\vulkan-1.dll (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):920064
                                                                                                                                                                                                                                                      Entropy (8bit):6.590744072045023
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:812631AE92F3EA931514EEC349D07CB5
                                                                                                                                                                                                                                                      SHA1:3AAC3CA97DA919BDE6951247BF922910BF0F5FB1
                                                                                                                                                                                                                                                      SHA-256:65369E9C55C5532D84B64A25F6A2DAEF19D4D8138691ACF0101FF904158533CA
                                                                                                                                                                                                                                                      SHA-512:AA8EEEDB7086C69C9956D00CA225F798AA7A29C757AC8F67C0560C6979D7CB149988A988FEA7A09E36645361BD972F603EB1E23C35ECCDC7909792F2D3D5D261
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........." .....2..........PH....................................................`A............................................<!......P................r..................<...8................... ...(....P..@............................................text...[1.......2.................. ..`.rdata.......P.......6..............@..@.data...@L...P..."...2..............@....pdata...r.......t...T..............@..@.gxfg...P)... ...*..................@..@.retplne.....P...........................tls.........`......................@..._RDATA..\....p......................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\wexond_resources.pak (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6910
                                                                                                                                                                                                                                                      Entropy (8bit):5.206278304311245
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5B52C922956FADBA0AC04E062BA7B58E
                                                                                                                                                                                                                                                      SHA1:3B5805BCD1D443EEC12812F1D6CAAFA9F9E2B311
                                                                                                                                                                                                                                                      SHA-256:1BFEA1F16B974C553D25E26367D43A413B076130366C1EFBD620C89A4E8BB352
                                                                                                                                                                                                                                                      SHA-512:5C1FEE2D4DED52D473B9DC694CD45F5A61E09494B605BB45889F850CF0F00A728760C18B06B31206FC20F04D6D8DCB34438E4248CD5B9D988F75D2AFCA3B23BD
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............H.*...0.B...\................{. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAia1M5QnDuWZyLm69sQ7FTTV+uCk7QQ3/ZZeWkFOo5cSBTtVumIJU5HcPyyGFkmDbN4zEpGATeYyxnbPPWuBPELcrjK+t3B7wgzyWU4pXb3nBxR9eHhejCPumlr0kHkAjvGRVkivIMLZYmOjKvkIqO4+tRGFIpcMRSVQtdfP7o9xocghOpuwI3awWtBHswEa8Nv52J1j1ErPmrWdatdMVs0GUWR5VJeb1GMCHpaquto/KaGzYtLHd7JFg2GcF7RpFinpvMLiw83Xp38bh5X7I3NlufYSuriZlpskiLrVRKYipKiXKEA5EMgW+0nYaN8SoAy0jf4JUaqkFYA5/WBsfPQIDAQAB",. "manifest_version": 3,. "name": "Shift",. "default_locale": "en",. "version": "1.0",. "app": {. "background": {. "service_worker": "service-worker.js",. "type": "module". }. },. "content_security_policy": {. "extension_pages": "script-src 'self' http://localhost:8097/; object-src 'self'". },. "display_in_launcher": true,. "display_in_new_tab_page": true,. "offline_enabled": true,. "permissions": [. "bookmarks",. "background",. "cookies",. "declarativeNetRequest",. "declarativeWebRequest",. "downl

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\127.2.2.1372\Installer\chrome.7z (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:7-zip archive data, version 0.4
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):378663861
                                                                                                                                                                                                                                                      Entropy (8bit):6.816341965354311
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1B437F91911CE00511EA84A61BD941BE
                                                                                                                                                                                                                                                      SHA1:97DCC635AE3E27EF8DD27F09337549CBF32A64B6
                                                                                                                                                                                                                                                      SHA-256:D09D4F854D77BFFC33B64C4EA9755D104A66F9164F03289F17C73C7BDE02E121
                                                                                                                                                                                                                                                      SHA-512:84EDD4CF7F761F86FF26EC83A0986E582261BD88FE59679C4ACA406EC1E59A41F6B6B7F99A2E22D53713133EA07A4D5700A70EE158785EFD0232EECC04B2D9FB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:7z..'.....>o......&.........u.<assembly.. xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>.. <assemblyIdentity.. name='127.2.2.1372'.. version='127.2.2.1372'.. type='win32'/>.. <file name='shift_elf.dll'/>..</assembly>..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|3..]...]...]..e\...]...\.5.]..e...]..wX...]..wY...]..e^...]..eX.y.]..eY...]..e]...]..eU./.]..e....]..e_...].Rich..].................PE..d...;............." ......8..........<).......................................K.......K...`A........................................`%G.x....(G.P.....J.@.....H.......J..%....J.....p.D.p....................S<.(...pR<.@............S<.(............................text.....8.......8................. ..`.rdata...F....8..P....8.............@..@.data...`....@G......@G.............@....pdata........H......@H.............@..@.rsrc...@.....J......@J.............@..@.reloc........J..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\SetupMetrics\86f92d36-7993-4afa-9b7d-0b554c33fda6.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                                                      Size (bytes):520
                                                                                                                                                                                                                                                      Entropy (8bit):3.761109325737151
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D7BDECBDDAC6262E516E22A4D6F24F0B
                                                                                                                                                                                                                                                      SHA1:1A633EE43641FA78FBE959D13FA18654FD4A90BE
                                                                                                                                                                                                                                                      SHA-256:DB3BE7C6D81B2387C39B32D15C096173022CCCEE1015571DD3E09F2A69B508A9
                                                                                                                                                                                                                                                      SHA-512:1E72DB18DE776FE264DB3052CE9A842C9766A720A9119FC6605F795C36D4C7BF8F77680C5564F36E591368CCD354104A7412F267C4157F04C4926BCE51AEEAA1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...@....................@...................X...............`... ...i.y.........SetupMetrics........i.y..Yd.X.......A.......e............,.........C*.3...................C*.3................UMA.PersistentAllocator.SetupMetrics.UsedPct....h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.0.......A...................V..>.....T.A.^.#.................T.A.^.#................UMA.PersistentAllocator.SetupMetrics.Errors..... ...i.y.[".....................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\SetupMetrics\9144_13374268131013198.pma (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):520
                                                                                                                                                                                                                                                      Entropy (8bit):3.761109325737151
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D7BDECBDDAC6262E516E22A4D6F24F0B
                                                                                                                                                                                                                                                      SHA1:1A633EE43641FA78FBE959D13FA18654FD4A90BE
                                                                                                                                                                                                                                                      SHA-256:DB3BE7C6D81B2387C39B32D15C096173022CCCEE1015571DD3E09F2A69B508A9
                                                                                                                                                                                                                                                      SHA-512:1E72DB18DE776FE264DB3052CE9A842C9766A720A9119FC6605F795C36D4C7BF8F77680C5564F36E591368CCD354104A7412F267C4157F04C4926BCE51AEEAA1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:...@....................@...................X...............`... ...i.y.........SetupMetrics........i.y..Yd.X.......A.......e............,.........C*.3...................C*.3................UMA.PersistentAllocator.SetupMetrics.UsedPct....h...i.y.[".................................!...&...+...0...6...;...@...E...K...P...U...Z...`...e...........i.y..Yd.0.......A...................V..>.....T.A.^.#.................T.A.^.#................UMA.PersistentAllocator.SetupMetrics.Errors..... ...i.y.[".....................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\debug.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                                                      Size (bytes):346
                                                                                                                                                                                                                                                      Entropy (8bit):5.176513912173713
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E1FA1A607CCB166DB7270F45956223C0
                                                                                                                                                                                                                                                      SHA1:4C4F3EA482697EB9D314A2A65AC0B350A51E333F
                                                                                                                                                                                                                                                      SHA-256:728915E488ECC461A831AC41AFA302D3744EAA4095EF946213F7286020B07396
                                                                                                                                                                                                                                                      SHA-512:912617FEB4B3E75929FFA8E544385EA6A70A8C670F441BE243A72F81F891FFDC602856855276118FDC27805673ACBEF19A041A2362CB0EF7271E86522A2E1179
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[1024/142725.199:ERROR:registration_protocol_win.cc(136)] TransactNamedPipe: The pipe has been ended. (0x6D).[1024/142729.254:INFO:chrome_exe_main_win.cc(297)] Second autolaunch detected..[1024/142738.594:INFO:chrome_exe_main_win.cc(297)] Second autolaunch detected..[1024/142746.452:INFO:chrome_exe_main_win.cc(297)] Second autolaunch detected..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\is-1QBQG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2255728
                                                                                                                                                                                                                                                      Entropy (8bit):6.46661685841436
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      SHA1:B42115C1CC613AF9BF2E709AC1C05C6F41ECCF04
                                                                                                                                                                                                                                                      SHA-256:47D15D0C44E5289BEBCB36694585D8126283B32C0FF5872F0F40F518E7F68EE8
                                                                                                                                                                                                                                                      SHA-512:CEC399D71CAF537155FE942600B93178BB104377DB68DEBF30978DFCE1C327D81C79AF38311217CD03F157C4CE199B9834CF78EF2FB5C77D87C139E11F80D9EA
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."................. 0.........@.............................P#......."...`................................................M...d....0..p............R".p....0#.........8...................`...(...p...@........... ...h.......`....................text............................... ..`.rdata.............................@..@.data........p.......P..............@....pdata...............D..............@..@.gxfg...p........0..................@..@.retplne.............*...................tls....1............,..............@...CPADinfo8............0..............@..._RDATA..\.... .......2..............@..@.rsrc...p....0.......4..............@..@.reloc.......0#.. ...2".............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\is-HDHJ0.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):989184
                                                                                                                                                                                                                                                      Entropy (8bit):6.404693383730192
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:620C72E410B9CAF3CF6C9CA4DD93D959
                                                                                                                                                                                                                                                      SHA1:7290E9419892D3FE500FD26ADB01949A657BD0D0
                                                                                                                                                                                                                                                      SHA-256:7E2C0048A183D786AF9D5A809ABF3561F6D759B86DD62DDD78137E50CDA74B82
                                                                                                                                                                                                                                                      SHA-512:B217952F18FDA031F50227B0637079B1BC0DFAEFEF6C49DC42A7D66F11FA39B342C5FB28613DA29B44AA55AE8E7B0883BD540CCFFC556E9C18A8C26ECD9C8C54
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."..........$.................@..........................................`.........................................p...T.......................xl..............0...............................(.......@...........H................................text............................... ..`.rdata..............................@..@.data...8r...........x..............@....pdata..xl.......n...^..............@..@.gxfg....'.......(..................@..@.retplne.................................tls....i...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\new_shift_proxy.exe (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2823680
                                                                                                                                                                                                                                                      Entropy (8bit):6.395970585855767
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:1D06621473A8216A98687546A595EC5D
                                                                                                                                                                                                                                                      SHA1:17672FD58998115E09D03BDF78574F44D30D99B7
                                                                                                                                                                                                                                                      SHA-256:5F125E8C60E15716E14F2A6B9E57F1088245A1F4547CCEB505835A7736027F29
                                                                                                                                                                                                                                                      SHA-512:8FD7DE0C2B7E22C7729ABBD2611FA5D4C68E4908827A6919ED059D0498DB7CB992A087B31DEC5A690281A9B0E03FC5EC5C2DF64C3B45EC11A3C5CC6F5B4BB0DF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....f.........."....... ..R.................@.............................p,...........`..........................................M$.N...DN$.T.....(.......'..............@,..!..|3$.....................P2$.(..... .@...........`[$.....hM$.@....................text...%. ....... ................. ..`.rdata...~.... ....... .............@..@.data.......@%......0%.............@....pdata........'......$&.............@..@.gxfg...p0....(..2....'.............@..@.retplne.....@(......H'..................tls.........P(......J'.............@...CPADinfo8....`(......L'.............@...LZMADEC......p(......N'............. ..`_RDATA..\.....(......`'.............@..@.rsrc.........(......b'.............@..@.reloc...!...@,.."....*.............@..B........................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\shift.exe (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2255728
                                                                                                                                                                                                                                                      Entropy (8bit):6.46661685841436
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      SHA1:B42115C1CC613AF9BF2E709AC1C05C6F41ECCF04
                                                                                                                                                                                                                                                      SHA-256:47D15D0C44E5289BEBCB36694585D8126283B32C0FF5872F0F40F518E7F68EE8
                                                                                                                                                                                                                                                      SHA-512:CEC399D71CAF537155FE942600B93178BB104377DB68DEBF30978DFCE1C327D81C79AF38311217CD03F157C4CE199B9834CF78EF2FB5C77D87C139E11F80D9EA
                                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."................. 0.........@.............................P#......."...`................................................M...d....0..p............R".p....0#.........8...................`...(...p...@........... ...h.......`....................text............................... ..`.rdata.............................@..@.data........p.......P..............@....pdata...............D..............@..@.gxfg...p........0..................@..@.retplne.............*...................tls....1............,..............@...CPADinfo8............0..............@..._RDATA..\.... .......2..............@..@.rsrc...p....0.......4..............@..@.reloc.......0#.. ...2".............@..B................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\chromium\shift_proxy.exe (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):989184
                                                                                                                                                                                                                                                      Entropy (8bit):6.404693383730192
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:620C72E410B9CAF3CF6C9CA4DD93D959
                                                                                                                                                                                                                                                      SHA1:7290E9419892D3FE500FD26ADB01949A657BD0D0
                                                                                                                                                                                                                                                      SHA-256:7E2C0048A183D786AF9D5A809ABF3561F6D759B86DD62DDD78137E50CDA74B82
                                                                                                                                                                                                                                                      SHA-512:B217952F18FDA031F50227B0637079B1BC0DFAEFEF6C49DC42A7D66F11FA39B342C5FB28613DA29B44AA55AE8E7B0883BD540CCFFC556E9C18A8C26ECD9C8C54
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Z..e.........."..........$.................@..........................................`.........................................p...T.......................xl..............0...............................(.......@...........H................................text............................... ..`.rdata..............................@..@.data...8r...........x..............@....pdata..xl.......n...^..............@..@.gxfg....'.......(..................@..@.retplne.................................tls....i...........................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\is-HTN68.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3525189
                                                                                                                                                                                                                                                      Entropy (8bit):6.593687422425807
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B6309E96693011FA83E6A3B874912F11
                                                                                                                                                                                                                                                      SHA1:FFBBFC2C12E974D2B627C897AC3ADE55F069E56C
                                                                                                                                                                                                                                                      SHA-256:ADA380BA9705BB1CD53C6CBF59988D56E553503CEB77A4E147FB2D5B702A3034
                                                                                                                                                                                                                                                      SHA-512:657009578C99FDF78B59C4183B553CA207B3ED8CEF523BE9E5167FB5B3CD84D843C6171EA3E099FDA00A9D67BE1A3FDF0B24E855C20E7818578454AE0D6DDDE1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@..........................P6...........@......@....................-.......-..9......X=...........................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc...X=.......>....-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\profile.ico

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:MS Windows icon resource - 8 icons, 16x16 with PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 24x24 with PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced, 32 bits/pixel
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):111220
                                                                                                                                                                                                                                                      Entropy (8bit):7.75148490252668
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4F1E89C25A3E6F45807823DC9F5DAB76
                                                                                                                                                                                                                                                      SHA1:06F033242AED3355FBAA42D54C03F5B919A52DAB
                                                                                                                                                                                                                                                      SHA-256:C28540390D9E25B5AFFE7864DA8AA40FBDAF7E29CB72B7A64B7EF401A2696B89
                                                                                                                                                                                                                                                      SHA-512:15D61066FD9A97DAD9DC92A2FED1B5CFCAFB87D5753146FC8505B91ACE77DDA9539C16FBA6DF5D1DA9BD91B15ED5D3F7FD0639DE85EE3E2BCBF5F25CE3F52F2A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:............ ............... .....!... .... .........00.... .L.......@@.... .....`"..``.... ..(..S9........ ..D..@b........ .........PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...0IDAT8Oe.yP.q......m..(...c..VY.a\.c...D..f4....^.4....$.FM9...L....C:Ix.~..nv......yf~.<.12.&...|NY.|d.X.H[%..m..3...Q..]...#ia..&F/,heF..b.CX.k...f....6..v9..@.!WR....)*.@...N..'l.k1z.[ ..V..`.....m.s...}....p...".%...v.D.v+[`.-X.h.u.s.R...P;...;^.SA.....F..s..).a8,...Ng^.:...d.d.....2].\......{c..[>H..t5.gI........ D..!....w.kR...4.*3!.z1.?AX....A..3..E..f3.....C.......CP`&H.)..n6b./...........p+1U..^....ef.L.CX.).O;.y~+.j.B\..&t.R:ZS...J./}4.1l..wB....ag......"...0...MDi..fD^.f.e(....0c~f;l..B._.u..O.(@...!)O yL..mD!..H.rJx..c.Bp...mFl....)o _T..+F...v.}H....i..d..<.aU...*O.O...M.a....;_......I...1...;.nx.pco..uX...V....../y..%A.....$..,.7..f$>3.........S...t....Px.a.l.d.D.9...o9....q...:Ur.}P....e....g.|.......7Cd..B...iJ..1......

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\unins000.dat

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:InnoSetup Log 64-bit Shift {95fcf903-63b1-44bd-ab77-358a5bd30aae}, version 0x418, 220268 bytes, 123716\37\user\37, C:\Users\user\AppData\Local\Shift\376\37
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):220268
                                                                                                                                                                                                                                                      Entropy (8bit):3.8096831093478434
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8DD3F906B138EC5A29A7D515CDEFED1B
                                                                                                                                                                                                                                                      SHA1:14CDE02432DBB932072C33D7C5A289C34DBC472A
                                                                                                                                                                                                                                                      SHA-256:71A9A501784F97AA1F7A5DE10C5D95B23338D6C9AC79B866409BB5DCA1254521
                                                                                                                                                                                                                                                      SHA-512:FD328865E03FA577555D5EEDBB66E614475D85B636F7CF51479CBBDF37F8E19DC4221958A3FA3EE18AA5114F3B1EFFE9BB3BD7323834581B8C23D94C9C4CF856
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:Inno Setup Uninstall Log (b) 64-bit.............................{95fcf903-63b1-44bd-ab77-358a5bd30aae}..........................................................................................Shift...................................................................................................................................l\..%...............................................................................................................G.R..........R.|...............1.2.3.7.1.6......A.r.t.h.u.r......C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t....................I.. .....".....=..IFPS....o.......J................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM............................#.................%...........

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Shift\unins000.exe (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3525189
                                                                                                                                                                                                                                                      Entropy (8bit):6.593687422425807
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B6309E96693011FA83E6A3B874912F11
                                                                                                                                                                                                                                                      SHA1:FFBBFC2C12E974D2B627C897AC3ADE55F069E56C
                                                                                                                                                                                                                                                      SHA-256:ADA380BA9705BB1CD53C6CBF59988D56E553503CEB77A4E147FB2D5B702A3034
                                                                                                                                                                                                                                                      SHA-512:657009578C99FDF78B59C4183B553CA207B3ED8CEF523BE9E5167FB5B3CD84D843C6171EA3E099FDA00A9D67BE1A3FDF0B24E855C20E7818578454AE0D6DDDE1
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@..........................P6...........@......@....................-.......-..9......X=...........................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc...X=.......>....-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\5513ae0e-0829-45e5-8a08-687de2e0a6a6.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3045002, page size 2048, file counter 4, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):49152
                                                                                                                                                                                                                                                      Entropy (8bit):0.86528072116055
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8CC409C8658C3F05143C1484A1719879
                                                                                                                                                                                                                                                      SHA1:909CDE14664C0E5F943764895E0A9DFEC7831FF5
                                                                                                                                                                                                                                                      SHA-256:BC69C3518DA2ABC8904F314F078D9672BAF3B840E09FD2B2E95D4B07A03A85A4
                                                                                                                                                                                                                                                      SHA-512:55D8923B6481ADF442817B7BAA50C36CBAD8DAC0EC600451813D29F4775DE519A06158A6233E61635CD0ED862E60AC7F50C75556C4E89D583D8A8A4299F1808F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................v.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\b7d83187-f12d-400e-9eef-32e548a836a1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      File Type:PNG image data, 1000 x 400, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                                                      Size (bytes):24898
                                                                                                                                                                                                                                                      Entropy (8bit):7.7614581089446935
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:8CFD938B1EFD79B772F3416F51CF51C7
                                                                                                                                                                                                                                                      SHA1:FF1FBE996A3F81A4F1DC592CB9AA02B383BBCEA7
                                                                                                                                                                                                                                                      SHA-256:84CC8D30172D2861A18BB5CF144CAC603D3602FBE062B63C7A8D9415D7208E8F
                                                                                                                                                                                                                                                      SHA-512:87182211017364266F1C2B4B5357D7742FAA99180B3F9AE138704362195D8D60F030B5B2FD7628F5A19A08AD91E370182250B5AA5DEF33C9472A25E8610BBDFC
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR.............=MJa....pHYs............... .IDATx.....T.}.q.I......$Mkm.&}.41}mk[M4..(....iMZQsQ...#...F.7.....Z..... ..., ,..........}~3..........~....3;.....|...?.(.......c..........................t......@......`..................@........:...... ......0..........t......@......`..................@........:...... ......0..........t......@......`..................@........:...... ......0..........t......@..........W.L@.Aw.@\_J....@..}...j.......G.....@....l..q......../:.... ...p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.:........p.z....u..@ug.._.....uxh..ry...-......@....G..O.[b\.u.N....\n...Y..p........@O8..\=....PN..W....J[.e..vv.}.\/.!o_..\E............p..y$...(.Du..]. a/.nmY........t ...@7kW..=..V...r...u..(......?../......@O8.........U;.0.v............H..=..t3vi...%.3.....nmMo..G..........p.z.....a..@....N..."}.a"....H".=........A..P>.8......@r...G..{..[.".c.....d!...@...FM.9...

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\chromium_installer.log

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):861
                                                                                                                                                                                                                                                      Entropy (8bit):5.396041954395693
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4CA6DD5921EC4F00EEF8B1FEBAE5CEB6
                                                                                                                                                                                                                                                      SHA1:B2734081B1DA1A450C81115232249E646191F9A0
                                                                                                                                                                                                                                                      SHA-256:FD71B32CE43E53F5AD463B5FB514A71BFE613CD617383B70D2703675543C1725
                                                                                                                                                                                                                                                      SHA-512:ADD7433770B8D3E858F6933329DE07D7A76AC67DA9BB3216A5D1694A91F1CF107DB20BD7BA918A5CE153D7AD5446E3238F2AF11083B8D186B171B02D845FEBFF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[1024/142850.629:VERBOSE1:setup_main.cc(1431)] Command Line: "C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0.[1024/142850.629:VERBOSE1:setup_main.cc(1437)] system install is 0.[1024/142850.629:VERBOSE1:installer_state.cc(87)] Install Chrome.[1024/142850.721:VERBOSE1:install_util.cc(247)] Windows NT 10.0.19042.[1024/142850.721:VERBOSE1:install.cc(120)] Creating per-user Desktop "Shift" shortcut to C:\Users\user\AppData\Local\Shift\chromium\shift.exe..[1024/142850.812:VERBOSE1:install.cc(120)] Creating per-user Quick Launch "Shift" shortcut to C:\Users\user\AppData\Local\Shift\chromium\shift.exe..[1024/142850.859:VERBOSE1:install.cc(120)] Creating per-user Start menu "Shift" shortcut to C:\Users\user\AppData\Local\Shift\chromium\shift.exe and pinning to the taskbar..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\Shift Setup.exe
                                                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):3501056
                                                                                                                                                                                                                                                      Entropy (8bit):6.606629807892353
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:DD387924C262802D2BDFB7C7201E3DF5
                                                                                                                                                                                                                                                      SHA1:7A0606877BB225426A035BF28A496CB45DD5AC77
                                                                                                                                                                                                                                                      SHA-256:57807A7121052F7BA40B2622357403D580F0D25EBADD35B98897C29218D75E17
                                                                                                                                                                                                                                                      SHA-512:FCFF0FEA8A6303FF6F4856F6AB58AC6D929098581127EFAE69168A754C3F80B7FF04B65FFB58858FEDAFED00C1A7BF54EE3A7E9D167CE67C4312135A13B8D9D3
                                                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,.........hf,......p,...@..........................P6...........@......@....................-.......-..9......X=...........................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,..*...&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......*-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc...X=.......>....-.............@..@..............1.......0.............@..@........................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\Win32Library.dll

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):50176
                                                                                                                                                                                                                                                      Entropy (8bit):5.776941773370921
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D82B30898C428A7DBEE81CECEA520F68
                                                                                                                                                                                                                                                      SHA1:AF89FA7F560C6CB183A293860E2638615F5D2001
                                                                                                                                                                                                                                                      SHA-256:92AF9D054E3B5DC9F472FF9534060D1C70E2AC77F768AE9E5029E29FCD606198
                                                                                                                                                                                                                                                      SHA-512:C334EDCB26275EFD2FD9DF4B68CCC874862E4B53CB13E2EDAC0C81E97BC6E9E1463CE938F4D74844FDAD7D38AD29FC6AA5582A0B0B13EECFFD8947685EB9F334
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....1e...........!................n.... ........... .......................@............@.............................(.......O............................ .......J............................................... ............... ..H............text...t.... ...................... ..`.sdata..............................@....rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\_isetup\_setup64.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6144
                                                                                                                                                                                                                                                      Entropy (8bit):4.720366600008286
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:E4211D6D009757C078A9FAC7FF4F03D4
                                                                                                                                                                                                                                                      SHA1:019CD56BA687D39D12D4B13991C9A42EA6BA03DA
                                                                                                                                                                                                                                                      SHA-256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
                                                                                                                                                                                                                                                      SHA-512:17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-10-light.png

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PNG image data, 304 x 240, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1181
                                                                                                                                                                                                                                                      Entropy (8bit):6.3531504585829595
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A879852024BF6DE33C3BB293704E6FE5
                                                                                                                                                                                                                                                      SHA1:8487AF86F572F80D18720157906C6B74DE2A52A8
                                                                                                                                                                                                                                                      SHA-256:A45A7BF12D8E17D5B05C81CC3BD5EE5E9299B9B522E4B883ED00808635D99BBA
                                                                                                                                                                                                                                                      SHA-512:34666447F27F4355F991B66E4781738400619A4553415060C2C0DDE59198B797999BE4F24734EE04FA3C1C6DD3B4EB26BA48C361CD891855B30EED7586D521A7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR...0..........d8.....iCCPICC profile..(.}.=H.@...JE*.. .:Y..q.*..Bi+..`r..41$)...k........... ......"%~..Z.x.q..}...w..2....4.6....H.W.h..`@f...,d.;.....].g...9....D<...&^'......"+.*.9.I.$~..........lz.X$.J..t0+....qT.t..r....8k..k..0\.3\.5....D....PA.6b..XH.y..?..S.R.U.#.<6.Av....Vqr.K........B.@..8...<.......o4..O..m-z..o...mM...w..'C6eW....E....).Dn..U.o.s.>.Y....pp...({...=.}.....@.r.(P.A....bKGD......e.......pHYs.................tIME..........F....tEXtComment.Created with GIMPW......uIDATx...;.. .DA>W...a.W....dF../...'.|....0....0@....@.....0....0@....@.....0....0@....@.....0....0@....@.....0....0@....@.....0....0@....@.....0....0@....@.....0....0.....@.....0....0.....@.....0....0.....@.....0....0.....@.....0.?D...... `............... `............... `............... `............... `............... `............... `............... `............... `... `.......... `... `.......... `... `.......... `..D.e.....0.....@....@.....0.....@....@.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-cancel-10-light.png

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PNG image data, 304 x 240, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):977
                                                                                                                                                                                                                                                      Entropy (8bit):5.584907780408753
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7631238B127E061A3509D98F83DA7487
                                                                                                                                                                                                                                                      SHA1:6C7AD20207BE9A0FDA44092DE3772743A594835B
                                                                                                                                                                                                                                                      SHA-256:160F9A1AC9CDEF54357CF709ECFF851B84001709BAF6C1516B77493597E41E39
                                                                                                                                                                                                                                                      SHA-512:2E5805C6C85BAF164B79B9358DEF543A4F3C3A9935D614BE86E9A1CDB6E3BD3C1A38CF9592BB4B324F668FD9E22E1ED3B4FA36B964FB92C2C27029DA2920F243
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR...0..........d8.....pHYs...%...%.IR$.....sRGB.........gAMA......a....fIDATx.....@.F.....`l.m..[..... .z.pN2........o.......=>...(.s>...d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...Y..d...%`@...s..Pb..Y.u]........`.....<.........0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 ky..<.@...d-.}.."......m.6....x^....0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K..,.......0 K....=....%..........J......IEND.B`.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-cancel-hover.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 304 x 80 x 32, resolution 5669 x 5669 px/m, cbSize 97334, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97334
                                                                                                                                                                                                                                                      Entropy (8bit):1.0714893298172896
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B34DA8405752BE3536E806A713CDAA0A
                                                                                                                                                                                                                                                      SHA1:306DAD4E3E20DD509E9A141733411D627D5E65A5
                                                                                                                                                                                                                                                      SHA-256:EF66B5012F06E05A7B6FEBDC593088FB87B210E15D90A0723D3992E527B92EF1
                                                                                                                                                                                                                                                      SHA-512:C6BCF4AC7D9262E00AFD0648F1B3C04E9C8A2735917E07D8B63F1F19B8C7B478FDA283B84E17A0C8540FE36B5F9ACA7D0F2A7FF538F9C2BF1D05D085DC96A8E5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6|......6...(...0...P..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-cancel-pressed.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 304 x 80 x 32, resolution 5669 x 5669 px/m, cbSize 97334, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97334
                                                                                                                                                                                                                                                      Entropy (8bit):1.0714893298172896
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:5AAEA0D32AE702F576D213E4E80637E7
                                                                                                                                                                                                                                                      SHA1:4CD512D7300667D3D1F046643561A1B376EC6628
                                                                                                                                                                                                                                                      SHA-256:AFEBC74C434CF001293B7E43530258BFC5570A296EBAE301056D6440BFE6B051
                                                                                                                                                                                                                                                      SHA-512:6CA63B86BF707A93D295AADB65F642F0D3B23F2A9DCD46B5B0AE08353ACED2B51EB23B8D2DEA6446FB742C949C145168914DDAC6981491D3486B42959498171E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6|......6...(...0...P..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-cancel-rest.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 304 x 80 x 32, resolution 5669 x 5669 px/m, cbSize 97334, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97334
                                                                                                                                                                                                                                                      Entropy (8bit):1.0714893298172896
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:742FB191CE19F165C648FB6D90C757AA
                                                                                                                                                                                                                                                      SHA1:632254FF7148DE8C51A9E95942DBA7AB33121CB3
                                                                                                                                                                                                                                                      SHA-256:A304983F48CED3971BF9882EF32AD2F4C59B1D23B8199ED5C5D27CC70941ACB2
                                                                                                                                                                                                                                                      SHA-512:3FD1CB5442063804F1AEB74A0A28715BCF714E77928690A6DA2B2D9DB2EBE05C26D6A8EEED3D46BA8D482E9B64381E9C2EBA5107FDD99E59258FC5DA67A27EB3
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6|......6...(...0...P..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-hover.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 304 x 80 x 32, resolution 2835 x 2835 px/m, cbSize 97334, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97334
                                                                                                                                                                                                                                                      Entropy (8bit):2.0067245075787934
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:82EBBC3800C3BB5E5E0B2215806FAB91
                                                                                                                                                                                                                                                      SHA1:65279E1491D28E66D721F8BD560345E1DF0E550B
                                                                                                                                                                                                                                                      SHA-256:CAC6CDAA9E776B7CD504152E90B760A650E008A3AF56AB73AF143457B4D50C38
                                                                                                                                                                                                                                                      SHA-512:F6A0A9F12330ABE42EA84A05128C078F6A2FDEC749C62203055F6A734A34E6B7B3A49A9847C091087821709530861B23B9A658D4A3F4575FBDD3AEF4EE2B2B48
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6|......6...(...0...P..... ...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-pressed.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 304 x 80 x 32, resolution 2835 x 2835 px/m, cbSize 97334, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97334
                                                                                                                                                                                                                                                      Entropy (8bit):2.0067245075787934
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B74A8ED182B79A9FCE54806727A79AFF
                                                                                                                                                                                                                                                      SHA1:00293992F5E6EA11C304EA627A8957C0E0AB26A8
                                                                                                                                                                                                                                                      SHA-256:27E358564C55757F04F682B0AAB12E80BA3D36D05E60234464305E6CF54EF0BC
                                                                                                                                                                                                                                                      SHA-512:16EABCC2B4A2006E875E925AB31DF42C3A6006620A9B979ED14DE61358A7F3AA20A25BB17AFBA7C50BD5194C22CF8D5766069E7DC10AD5E0ADDF97CE2B773067
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6|......6...(...0...P..... ..........................[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[...[

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\button-rest.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 304 x 80 x 32, resolution 2835 x 2835 px/m, cbSize 97334, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):97334
                                                                                                                                                                                                                                                      Entropy (8bit):2.0067245075787934
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:35B504CA889960B5EF306894DC9315FE
                                                                                                                                                                                                                                                      SHA1:38E0FDA1828DE12F9C88F4BE2711CDC413A7FF8B
                                                                                                                                                                                                                                                      SHA-256:85386BD819C2A097ABF8225E96980235D536A825629C9481AAFEDA3C09055D91
                                                                                                                                                                                                                                                      SHA-512:3055D9EB57BA71270CE420C5691C11900CC00DE5E79689FAB772C7CD26DC10760615E6FAEC746C06D0F79FA8C0876D38E946555054D994EF28AC8C7A1C348A82
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6|......6...(...0...P..... ..........................k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k...k

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\checkmark-10-light.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 32 x 32 x 32, resolution 3780 x 3780 px/m, cbSize 4150, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):4150
                                                                                                                                                                                                                                                      Entropy (8bit):2.8650206999627694
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B44D6DC836E9611AE20DA70754AF360F
                                                                                                                                                                                                                                                      SHA1:9566706032BE3E6118E7BD0D63101C5858C2110E
                                                                                                                                                                                                                                                      SHA-256:CE12D9D70B17337E6197FF86832F7A42247792CD989EEA27A2BE6F6CE2EBCBCD
                                                                                                                                                                                                                                                      SHA-512:CF1A09F8774528995B79C98ABDA56279236F3EAB588A3C22192D85527A2E5BDE22EAC2BCE9B2DC5DD6BD66631C7F8DC9F8B3BF99D940F01CF7BD230A1150D481
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6.......6...(... ... ..... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................Z.....x...x...x...x...x...x......Z..................................................................................Z..x...x...x...x...x...x...x...x...x...x...x...x...Z........................................................................x...x...x...x...x...x...x...x...x...x...x...x...x...x..................................................................x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x...x......................................................x...x...x...x...x...x...x

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\checkmark-10-light.png

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PNG image data, 32 x 32, 4-bit colormap, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):363
                                                                                                                                                                                                                                                      Entropy (8bit):6.445618577053504
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A4D4DC66A41D9C3B54A2ED3EE8D4B3DF
                                                                                                                                                                                                                                                      SHA1:E91A5E7A6690C14C6F799E2433BEB2F6388C4DF6
                                                                                                                                                                                                                                                      SHA-256:46E9C171E2115CD43E5D05F6A5F6015B27BDA065FBAB939916FEE2FD5C06D5A4
                                                                                                                                                                                                                                                      SHA-512:99D5425AA653B93D0B6065020F88C095C39D982FB20A0ED0078418E8E862A104B4F0392791C79D2DF86410A0BA5BA60E644852943A9FC602F7EAF82FECAAEFD4
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR... ... ......Tg.....gAMA......a.....sRGB........'PLTEGpL.x..x.....x..x..x..y..x..w..w..x..x...k.....tRNS.!...@`P....$H....IDAT(.c` .0... .%t.9...............@..(8........B`1X..!p..g<.....,0.$ ...`..O.......T`2..8....*0...G..5@ZP....4.;.. ....jQdt.+.k..yK....l(.ZE....`.....p..t..1X!..!!..(.....:....X..@....#..Q...O. 6.............IEND.B`.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\exit-10-light.png

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PNG image data, 96 x 192, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):6986
                                                                                                                                                                                                                                                      Entropy (8bit):6.1710732658669105
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2CCE6763F61DDDB4599CB058D6761C56
                                                                                                                                                                                                                                                      SHA1:40BB1A5E735E52791C7C3F0A22CA4A63EC9A3737
                                                                                                                                                                                                                                                      SHA-256:0FC8E40A3B0E7A516E108DC0F3267DCCCB4DE04D28A21EB68A45A8AC1BB9DF8F
                                                                                                                                                                                                                                                      SHA-512:BDA0D42E1A844B2A9608816B07160EE42E1F4C8705D820CADF5CD5E714B7C9FB0C6E066DB04B74D573A1F8F435324D807634648C348D5E456A61CC9DAB684FA2
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR...`...........f....6zTXtRaw profile type exif..x..mz.*.....Y...`9|>..`.?/....+};w..Uvl.G:B:j.......'.....\s.|RM54...?.......G....o...".x.Y.7..Op..W.a...$.........A....D..(...<....R.}4...<.,)...<n..y...dxo*...V.............v.2Pb.:..D{...W~z.T...5.....[oW.+[)<C..'.....N.5+..?...s.>...v.}....=.l..2..Qo.\W..,q...h.._e....Q..A(L?|..R%@.$S.lY.y..b.....!......j...Cv.X.....G.w,r-[.p.j...04......./.}....._.~C8...a..2.Fd?N...o....5../.-Rql...*.e.x......=(6..p.K+`$...IT..-........CL......b.pS.Y.WL..A....If0.1....5.JI..K..j.5.jV.U[.9e.9[>I.Y..L-.Y.j....\..RK..F...\..Zkk....vc@k=..SW.s.^z.m.>#..y.(..6...1.Yf.m.".VZ..UV]m.j;....m.]w{gM.m....k.....@{g..foS.I'z8..........p8.ER......]...z8.r....$.7.\..=..O.9K.x...9w..!s.....y....w.q...m...Z...}....1#./.LG.N6..3.....(.....z.....i...`.w..z..e....u..;&.b...q.g._.....%..Z..!#&.........>.m./'.A.*....h..=.5../N...Z.....i....Ak.c..VdX7....I9.:u8]..|.60....!"q.Ed.@..z..I..C.~t..0.a....i.*b=f@.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\exit-hover.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 96 x 64 x 32, resolution 5669 x 5669 px/m, cbSize 24630, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24630
                                                                                                                                                                                                                                                      Entropy (8bit):1.7452965745987936
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D33F497718C0BF3C5705941BA5666A5A
                                                                                                                                                                                                                                                      SHA1:61107329DD6576AEC0B2CDF34EB146D24748D2E8
                                                                                                                                                                                                                                                      SHA-256:C61FB1333511D8E78C4606DD2A800F1CF9D94307B26C01862128FF11C0B5E333
                                                                                                                                                                                                                                                      SHA-512:E6F2C2E7F6B3A4AD4899DCC547ADF16A61F823096B7530C5422E3989D94A2D1AE0E138E382304AB2942BEEF949D1193DE485097A2DDA8C54C0E998EA589F3C39
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6`......6...(...`...@..... .........%...%...........CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC..CC

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\exit-pressed.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 96 x 64 x 32, resolution 5669 x 5669 px/m, cbSize 24630, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24630
                                                                                                                                                                                                                                                      Entropy (8bit):1.731446850397158
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:53178FD9661AE74BBFA7A562653A7773
                                                                                                                                                                                                                                                      SHA1:FA3BAAE7B8442F47DFA18AAC1361112F7E8E3C4B
                                                                                                                                                                                                                                                      SHA-256:FFE6D8F0EA0ACB8660389C9E7F399133BC570803789638AA884AE2F247D8BF10
                                                                                                                                                                                                                                                      SHA-512:C50C0822F228C123B41A4B14A63F625B3A299FAA36322D98A2DB001774953A342058149C90971D4E3E713005E5481BC92ED2F03D5D86FFAF415CCD565AEFB913
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6`......6...(...`...@..... .........%...%...........==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==..==

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\exit-rest.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 96 x 64 x 32, resolution 5669 x 5669 px/m, cbSize 24630, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24630
                                                                                                                                                                                                                                                      Entropy (8bit):1.0551032985832818
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:B8AD3B36AE539BBB3D8C41FAA57FE4F6
                                                                                                                                                                                                                                                      SHA1:16E75AA762DF3EDD1DDCB69B7A0AEE196C553E7C
                                                                                                                                                                                                                                                      SHA-256:33BD571330E590730A52C6880EA744A63B8D5342A0C8BF2DF871C41D190D57F0
                                                                                                                                                                                                                                                      SHA-512:158341605CE52FA2E7EE1BBDFE8A5D4A42115BB1063F4826A560156E0634F1A35A39A65B9A949F2C7ADE96B9B592C936309F99E75A9FFF4630C40DF530322E09
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6`......6...(...`...@..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\features.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):85
                                                                                                                                                                                                                                                      Entropy (8bit):4.259941237264318
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D3302C38D5B898DB55E84B75BB08EC60
                                                                                                                                                                                                                                                      SHA1:BEAF7C00E8ABED8DBB0475C2648A6C1142B797F4
                                                                                                                                                                                                                                                      SHA-256:500F290E50C1FD5A211A56EB98DE96F5E08BBF527B1276390BA933F40D786A8B
                                                                                                                                                                                                                                                      SHA-512:628EE659C541B3610B81E1EB1C8C672B19BD4D1508505D2F09638040841C78A32E514D00324DAED26B221986B5FCCD71B3E5DD57096E651DB26BF2888F32B223
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "shift":["Browser","Apps","Free"],. "recipe":["Recipe Search","Quick","Free"].}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-0J1TG.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8
                                                                                                                                                                                                                                                      Entropy (8bit):1.75
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:80BDFC1DF74AA6B62C4C347085929D68
                                                                                                                                                                                                                                                      SHA1:D44629439799D2B0F62D2CA56D2E23900F1E7561
                                                                                                                                                                                                                                                      SHA-256:775C691377D832F158259EBCDF81417CD8F28C0D08F0AA0E750FE9AE7E7E1BB6
                                                                                                                                                                                                                                                      SHA-512:1948B043DD6472E1DDDA48ABEB8DC22A594CDF61B189BAC8E89F5C8E5459CCC5942DA7F40E4A05097856991352383C55C20109D7AAA508126C8946AF1C7D04C7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[. .]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-1HPL1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):272
                                                                                                                                                                                                                                                      Entropy (8bit):4.68911504845431
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:45906ED3BDAA905A521376AC08F022AA
                                                                                                                                                                                                                                                      SHA1:D0A1539DEC095BC931CDA64A9464596D9CCD79AB
                                                                                                                                                                                                                                                      SHA-256:690AF42EA919E877C7D456D36F17441049A69A7825296D210726C500202DD3D7
                                                                                                                                                                                                                                                      SHA-512:B0E08ED2708F354B9CA10CEFC29CD6B1DF74B12ED71DB1BCA76ED36084D539A2F4AC9C5F71DC139F66BB6FBA6561D88000CC0F36E29222132135EA568736667E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "pdf_de":"PDF-Dateien kostenlos anzeigen, erstellen, verwalten und konvertieren! Installieren Sie OneLaunch, um .ber eine allgegenw.rtige Suchanwendung, die sich bequem oben auf Ihrem Desktop befindet, auf alle PDF-Funktionen zuzugreifen, die Sie ben.tigen.".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-1IHQC.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45
                                                                                                                                                                                                                                                      Entropy (8bit):4.143607886039518
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FCF5824A26B8B0042094E525FB56BDA5
                                                                                                                                                                                                                                                      SHA1:397A47119F8F33BBF3442E2EA625AA1D7A1AD062
                                                                                                                                                                                                                                                      SHA-256:5A9DB04B24DCA5ABE17A5802A41D68D48B880894840DC919557AF87C678E8A97
                                                                                                                                                                                                                                                      SHA-512:EECB87C2CD995EC3B4525C499326C4C752929477BA2847AAD24EC9B4FFE3BA390B819F0717DDC40CD8D593FC14289B9A633003F3FD5169E5C755BFC133D7776A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "recipe":"Thousands Of Free Recipes".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-2IT14.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):85
                                                                                                                                                                                                                                                      Entropy (8bit):4.259941237264318
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:D3302C38D5B898DB55E84B75BB08EC60
                                                                                                                                                                                                                                                      SHA1:BEAF7C00E8ABED8DBB0475C2648A6C1142B797F4
                                                                                                                                                                                                                                                      SHA-256:500F290E50C1FD5A211A56EB98DE96F5E08BBF527B1276390BA933F40D786A8B
                                                                                                                                                                                                                                                      SHA-512:628EE659C541B3610B81E1EB1C8C672B19BD4D1508505D2F09638040841C78A32E514D00324DAED26B221986B5FCCD71B3E5DD57096E651DB26BF2888F32B223
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "shift":["Browser","Apps","Free"],. "recipe":["Recipe Search","Quick","Free"].}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-55K2F.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):56
                                                                                                                                                                                                                                                      Entropy (8bit):4.595313797398191
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7D7F59D80E315772660C286FF008A5B9
                                                                                                                                                                                                                                                      SHA1:D315377FD1F651F363BA8A006FA050AB29991AF0
                                                                                                                                                                                                                                                      SHA-256:CB43174A854E808EB864A49B2C354A0722086D94DCDCE34F6F6E776F5089D07C
                                                                                                                                                                                                                                                      SHA-512:BFE833C198FA9AF71DAA26D85E568884FCC103BAD1446DB1A1B5614D1E0719B175574A55F83B974CB05AF9D789CB38839A358F4B766ADBE8D91DBECDF23AAA2C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "pdf_de":["PDFs bearbeiten","Einfach","Kostenlos"].}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-5O2NP.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):188
                                                                                                                                                                                                                                                      Entropy (8bit):4.271913721622814
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9C2AB31EAF470EA5F8D259155DD7D990
                                                                                                                                                                                                                                                      SHA1:50F9DB9F3EBE3611493DC5DAAEC5B4ED8014E31C
                                                                                                                                                                                                                                                      SHA-256:246F2C0E7E63B873F55805879DFF85FDA2B0E5CE7773DFD543CA825C1D6418AA
                                                                                                                                                                                                                                                      SHA-512:A847E7FE271B626570BC7BEB72C19C1189F42D9B484FD6D6DE5E61659D784C3607B8EB0B460CD89C6FEA881EE7D7C13DE5351B05001E9BD7385F2CA272B70AC0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "recipe":"Get all the recipes you need easily and for free! Install Shift to find recipes from an omni-present search application located conveniently at the top of your desktop.".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-7E4H9.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                                                                      Entropy (8bit):4.607258938909887
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BC4A4D5AA3C2CA658E18FCC1AE4FFD4B
                                                                                                                                                                                                                                                      SHA1:D9020350E6B164B316CA62783C50D17150A485C4
                                                                                                                                                                                                                                                      SHA-256:46F7AC669F29E6FE3DDAD919637237CCAAAED48EE93CD5E6E88C9C11A561399B
                                                                                                                                                                                                                                                      SHA-512:0831D593EE49781D7B8F25EEDC46E55F024C74EC253A6B280A8D9E9857F3FBFA576BE79F9662734EA7E81EB0B29519C0296F2A1593622EAC0DEFEB5DB60573BF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "pdf_de":"Kostenlose PDF-Software - Einfach und kostenlos".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-AJBH1.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):418
                                                                                                                                                                                                                                                      Entropy (8bit):4.446385973499709
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46A179D67CC8FB8B37A7D9CD6D6C9AFA
                                                                                                                                                                                                                                                      SHA1:6957FC193324230B4C205283067FE2CD1664E45F
                                                                                                                                                                                                                                                      SHA-256:C1C05FFE107231855D0769C7A8F75A0967C4F1F0B02BF86F74D79C6B3DF6FF52
                                                                                                                                                                                                                                                      SHA-512:D4FEED841D601907C38A30B134857E7FF039348CECFFD495CCD32607E73A839FA40EE45D28553BCD8B4D3325CF878D60DED87AB420A81B98F3A825AEE2159493
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "yes_de":"Sim",. "yes_pt":"Instalando...",. "yes_es":"S.",. "yes_fr":"Oui",. "no_de":"NEIN",. "no_pt":"N.o",. "no_es":"No",. "no_fr":"Non",. "accept_de":"Akzeptieren und Installieren",. "accept_pt":"Aceitar e instalar",. "accept_es":"Aceptar e Instalar",. "accept_fr":"Accepter et Installer",. "cancel_de":"Stornieren",. "cancel_pt":"Cancelar",. "cancel_es":"Cancelar",. "cancel_fr":"Annuler".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-L0O7P.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):101
                                                                                                                                                                                                                                                      Entropy (8bit):4.150882972285169
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:60123A55D6FC49B00468D7D57FAFA8B2
                                                                                                                                                                                                                                                      SHA1:5865BD3C61895006872C9C50B20C7AE64BB5852E
                                                                                                                                                                                                                                                      SHA-256:44C8AB3CA2C6998A559947EFD92969E119534EEDC940F5E12F4BE8C0296E727A
                                                                                                                                                                                                                                                      SHA-512:C7BC689F5F656F252A8A31C2FB84ED20A4EEF9CA574ECB63D1C17CC6B0997D075558A464996EB867FE2897911F7B091500E35E96F856979DB72A5B37F8418E52
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "de":"Vorbereiten",. "pt":"Preparando",. "es":"Preparando",. "fr":"En train de pr.parer".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-U0HSD.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):129
                                                                                                                                                                                                                                                      Entropy (8bit):4.422199907535269
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:265F6765AFE190501E0CA8CB6DE26BC2
                                                                                                                                                                                                                                                      SHA1:2F233BDC6A0BE1FD65ED4FB31AC52987FDFA9940
                                                                                                                                                                                                                                                      SHA-256:C913945E578B1E113FF1B858F79B89E837E203C81E79FAAB3F97FEAD72C70849
                                                                                                                                                                                                                                                      SHA-512:7D326B56097A1973FA5840AB0D59761BA85CFF85E3E40F5B09872408DA0AACA8936CCC7F4ED74B23C64C52DF89A240E018B7E18FD36A5B603A83BDB14D0BB0E7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "de":"Installation l.uft...",. "pt":"Instalando...",. "es":"En train de pr.parer",. "fr":"Installation en cours...".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\is-VI737.tmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):530
                                                                                                                                                                                                                                                      Entropy (8bit):4.715248443389503
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:ED4BF5C4C8CC1FB71925CAEB2C3A9022
                                                                                                                                                                                                                                                      SHA1:200974BA3A4464AB16E3BE09766E997889D0F79C
                                                                                                                                                                                                                                                      SHA-256:10F399448FDCB2A5C2BA854751DE5793670BEC2DAE05CBB5D75343D33CF705E5
                                                                                                                                                                                                                                                      SHA-512:0A3AB15492B284FC853E42CF6B61DC45DFEF3ED2A370E1D6FE94E0F67E76B0F7B4132C66BD52F5087154F6F30E916F97DBE8ED773695BFAAD28C9EFB52B000BB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "de":"Die Einrichtung ist nicht abgeschlossen. Wenn Sie jetzt beenden, wird das Programm nicht installiert. Installation verlassen?",. "pt":"A configura..o n.o est. conclu.da. Se voc. sair agora, o programa n.o ser. instalado. Sair da configura..o?",. "es":"La configuraci.n no est. completa. Si sale ahora, el programa no se instalar.. .Salir de la configuraci.n?",. "fr":"La configuration n''est pas termin.e. Si vous quittez maintenant, le programme ne sera pas install.. Quitter la configuration?".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\min-10-light.png

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PNG image data, 96 x 192, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):5793
                                                                                                                                                                                                                                                      Entropy (8bit):5.506205157290013
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2257B1D0D33A41F509E7C3E117819F8B
                                                                                                                                                                                                                                                      SHA1:87583BFBC655AEC4E8CC4465B341C3F7889A6317
                                                                                                                                                                                                                                                      SHA-256:D43E4B285B5B54313B53E87D2A56CA9BA0C85F8F55C9C5FDCDB4FAC815FF4D02
                                                                                                                                                                                                                                                      SHA-512:702D1A126A0A7A64AF5CEE9450DAEED74364AA9E9F123E1BC398ECD4215C082E7F55E43DD292A4119749E84999B015109BFF8B11732DF11143D202B385411CC5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR...`...........f....,zTXtRaw profile type exif..x.W[v.(..g...$$...y..`.?%?z.....d... ......?........h.\s...J...j......W.~.k...`4%...i..t....Y4..#.<Q..Q..oO.....Q...z9J|v..k)...%.u..^..O.W.....}.-..M.8.y%J.oNvN ..!5T...!%A]R.[.$...N..bF.*...c.~..]..l._&....(?l....r@.fd.....'..B|B....c.XE....{)G.v.C..../.G..w.m..P.q.{P%.]..&5..r....W`p....h..H'..isI5.d y...V~..ak....0.$.2..y\.z.W?..S.(^.../...i8s.....}......|9......)R.l?]t... .D'.*.3..... ...P..`..R.X....4..0uN....*OL..8........a..h.h....M.9g`..,.E..1.P...Y..Vm9e.s..E..T$.-..b..f....3..*....k.Vkm.c6xn......=u..z.[......#.2l..&.4..3.2m...-...+..l..6Bm..e..l.u..kt.....kt...SnX..........s..8..... ..9.F"..9g.2.B..T.l.3..e....'...x.E....e.8u/2.+o..6}...cg.:.1!.v.......2.....uGm#o..0.@...6....Q.....,......V......H]i.9......'.=.g.....<.<Y.'...N.N'.j.....}.R+.*.....5?h4.w.....C..6..U..|$......iM.F........_..'K....2|f.X..DE...U.,DA...4....<..$...$..K_.HhT..\.&{SC.P..A..q.7-8d(#E=b0f..

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\min-hover.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 96 x 64 x 32, resolution 5669 x 5669 px/m, cbSize 24630, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24630
                                                                                                                                                                                                                                                      Entropy (8bit):0.08151757699737566
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:C94A77553F2C392D5F1FE2F08E30EFB2
                                                                                                                                                                                                                                                      SHA1:8FB56E5E4896133281A2627A92A3A33D13E378C5
                                                                                                                                                                                                                                                      SHA-256:8DAA69B6252F6F773CEB6D7090664B933537478731473E1B54CAF67791C2D336
                                                                                                                                                                                                                                                      SHA-512:8E22363FF52C116B5D36BE212F79B610C520CB156B8902BE501B8420A7568D62CF52C6742EF03F328558B506D47B9421ADD713A916AB0F5BFABD4E7422F10587
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6`......6...(...`...@..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\min-pressed.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 96 x 64 x 32, resolution 5669 x 5669 px/m, cbSize 24630, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24630
                                                                                                                                                                                                                                                      Entropy (8bit):0.8883785617172046
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4B549427F8B753A01272BEC3A658E7BA
                                                                                                                                                                                                                                                      SHA1:8DB761FC5A1DE900858D193D54759ED9F910BB71
                                                                                                                                                                                                                                                      SHA-256:FE03E30C13229D50685E3387F4F271BEFE57DFA74BE890D09C089FB3688469A1
                                                                                                                                                                                                                                                      SHA-512:D84CDFB52D88BD25A09F805CCC8968ECA7054F55C50673A7919DDB146ED65B3B8B36B1C70469C12655E8ADE5202E257491D648E0FAFE527C289747ED8F34EC4D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6`......6...(...`...@..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\min-rest.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 96 x 64 x 32, resolution 5669 x 5669 px/m, cbSize 24630, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):24630
                                                                                                                                                                                                                                                      Entropy (8bit):0.8883785617172046
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2484489C7443EC4745488A77ED084D80
                                                                                                                                                                                                                                                      SHA1:FCF49D1BE8BBBAE3D0DEA49BB5E677FB19D98D9D
                                                                                                                                                                                                                                                      SHA-256:70B6921812F29B698F454927802DB818C1625402BAEFD53CED1BFB9135C17D5A
                                                                                                                                                                                                                                                      SHA-512:A4776969B6BF215A85E7CFBC8F13DBB1BEB4EF42EB5ABFA572BB7F54C0032941C8BB178E7B77EDA0C442741C29FCCB02D8DE157068DD31203BFED4E49CE051A5
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6`......6...(...`...@..... .........%...%.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\profile_descriptions.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):188
                                                                                                                                                                                                                                                      Entropy (8bit):4.271913721622814
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:9C2AB31EAF470EA5F8D259155DD7D990
                                                                                                                                                                                                                                                      SHA1:50F9DB9F3EBE3611493DC5DAAEC5B4ED8014E31C
                                                                                                                                                                                                                                                      SHA-256:246F2C0E7E63B873F55805879DFF85FDA2B0E5CE7773DFD543CA825C1D6418AA
                                                                                                                                                                                                                                                      SHA-512:A847E7FE271B626570BC7BEB72C19C1189F42D9B484FD6D6DE5E61659D784C3607B8EB0B460CD89C6FEA881EE7D7C13DE5351B05001E9BD7385F2CA272B70AC0
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "recipe":"Get all the recipes you need easily and for free! Install Shift to find recipes from an omni-present search application located conveniently at the top of your desktop.".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\profile_headlines.json

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):45
                                                                                                                                                                                                                                                      Entropy (8bit):4.143607886039518
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:FCF5824A26B8B0042094E525FB56BDA5
                                                                                                                                                                                                                                                      SHA1:397A47119F8F33BBF3442E2EA625AA1D7A1AD062
                                                                                                                                                                                                                                                      SHA-256:5A9DB04B24DCA5ABE17A5802A41D68D48B880894840DC919557AF87C678E8A97
                                                                                                                                                                                                                                                      SHA-512:EECB87C2CD995EC3B4525C499326C4C752929477BA2847AAD24EC9B4FFE3BA390B819F0717DDC40CD8D593FC14289B9A633003F3FD5169E5C755BFC133D7776A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "recipe":"Thousands Of Free Recipes".}.

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\shift.bmp

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 432 x 432 x 32, resolution 2835 x 2835 px/m, cbSize 746550, bits offset 54
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):746550
                                                                                                                                                                                                                                                      Entropy (8bit):5.963449006448608
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:6C091E46C4B50CBE372A0826B8D38331
                                                                                                                                                                                                                                                      SHA1:C543565FC4BB40CC3064C74CACB32DD5DAAF10E3
                                                                                                                                                                                                                                                      SHA-256:385B8FD4363F4A13469B1E9BCF21365FF7BBD9DD4CD90E52B290FC89DDE1927C
                                                                                                                                                                                                                                                      SHA-512:0F97BE96218FD3A1891A483DD207129600F86676EEA8175E366615EFB9DBF662EDC339F9EFFF68D1BCAB25AB5017C7DDF32E4E3A115CDEDBC8442A90FE883D55
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:BM6d......6...(............. .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................np..np..QU..QU..QU.~5:.~59.~4:.u',.l...m...l...k...k...k...k...k...k...t.".|28.{27..5:..7<..HN..SX..di..rv..uy......................

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\shift.png

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:PNG image data, 432 x 432, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):137549
                                                                                                                                                                                                                                                      Entropy (8bit):7.9956263511639065
                                                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:0423D0589E58341B5B64C6099F4123B7
                                                                                                                                                                                                                                                      SHA1:4936C3104AF415DD882CAA94DA80A8AF600685C5
                                                                                                                                                                                                                                                      SHA-256:A1D2C48437058F24A5EA85C323469473AC4430198770794522A32C28783AADB7
                                                                                                                                                                                                                                                      SHA-512:2C1D63AB401FF6D12B1935AC04F8CB9DE3AFE63D03EE1C8F9103250ED21F41CDDDEE955F26B5B1395EA3D324073A2B1E0C6B03F024966297724DCE3E3840E05A
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.PNG........IHDR..............N0*....pHYs.................sRGB.........gAMA......a.....IDATx...[.n.q..u.s...p.^$R.x(9..T....f*#a\.DS..4N..Fx.R5....*.....K.(?......e.C.vel..0.)Q.X$EK.H..EQ ..~=....{w............-...o...z...^...rL.tLk..q;?...|........'.../...........NDM..l.gz~.;...E....k..v. ...<.....w..j.3..........@...kY..dZ....=...+"gE.x.g.....1..T..^'i....NNn....../\~..w^y.....'........[..^y...%.@.J.?..._h..H~7..Y...z.f.Z.2....:.EY.@8.Z.[...-H.........c...........M.....w}B..^...`...J.H.. u.+.d:.N=.+.^...>}..C...Kr....d.)...6.J....BV.Y........|.B.[..5@I......h.=..9.Y49.xa.9..=.d....h....&.O..p..O^w..'...]..1..k$...^.iq....rFn.....a................Y...s2[Xe-%8-X. q..g......._..V...@..TnC.....@....'.f.W#[\+...5.-.u...y+.E...x..I..........3g........U...vL...m..t..RwL2}.,.o.%..><wE.}......d..._y.,.......^...p...<..S........f...@L@.,.\K........u5..........Jk..H]...B..d.r......Q?...k...v......<..>.....XW'rr.,..d.*..:...h=...<.ZY..I..[

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\split_tests.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:ASCII text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):8
                                                                                                                                                                                                                                                      Entropy (8bit):1.75
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:80BDFC1DF74AA6B62C4C347085929D68
                                                                                                                                                                                                                                                      SHA1:D44629439799D2B0F62D2CA56D2E23900F1E7561
                                                                                                                                                                                                                                                      SHA-256:775C691377D832F158259EBCDF81417CD8F28C0D08F0AA0E750FE9AE7E7E1BB6
                                                                                                                                                                                                                                                      SHA-512:1948B043DD6472E1DDDA48ABEB8DC22A594CDF61B189BAC8E89F5C8E5459CCC5942DA7F40E4A05097856991352383C55C20109D7AAA508126C8946AF1C7D04C7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:[. .]

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_caption.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):129
                                                                                                                                                                                                                                                      Entropy (8bit):4.422199907535269
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:265F6765AFE190501E0CA8CB6DE26BC2
                                                                                                                                                                                                                                                      SHA1:2F233BDC6A0BE1FD65ED4FB31AC52987FDFA9940
                                                                                                                                                                                                                                                      SHA-256:C913945E578B1E113FF1B858F79B89E837E203C81E79FAAB3F97FEAD72C70849
                                                                                                                                                                                                                                                      SHA-512:7D326B56097A1973FA5840AB0D59761BA85CFF85E3E40F5B09872408DA0AACA8936CCC7F4ED74B23C64C52DF89A240E018B7E18FD36A5B603A83BDB14D0BB0E7
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "de":"Installation l.uft...",. "pt":"Instalando...",. "es":"En train de pr.parer",. "fr":"Installation en cours...".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_exit_message.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):530
                                                                                                                                                                                                                                                      Entropy (8bit):4.715248443389503
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:ED4BF5C4C8CC1FB71925CAEB2C3A9022
                                                                                                                                                                                                                                                      SHA1:200974BA3A4464AB16E3BE09766E997889D0F79C
                                                                                                                                                                                                                                                      SHA-256:10F399448FDCB2A5C2BA854751DE5793670BEC2DAE05CBB5D75343D33CF705E5
                                                                                                                                                                                                                                                      SHA-512:0A3AB15492B284FC853E42CF6B61DC45DFEF3ED2A370E1D6FE94E0F67E76B0F7B4132C66BD52F5087154F6F30E916F97DBE8ED773695BFAAD28C9EFB52B000BB
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "de":"Die Einrichtung ist nicht abgeschlossen. Wenn Sie jetzt beenden, wird das Programm nicht installiert. Installation verlassen?",. "pt":"A configura..o n.o est. conclu.da. Se voc. sair agora, o programa n.o ser. instalado. Sair da configura..o?",. "es":"La configuraci.n no est. completa. Si sale ahora, el programa no se instalar.. .Salir de la configuraci.n?",. "fr":"La configuration n''est pas termin.e. Si vous quittez maintenant, le programme ne sera pas install.. Quitter la configuration?".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_features.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):56
                                                                                                                                                                                                                                                      Entropy (8bit):4.595313797398191
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:7D7F59D80E315772660C286FF008A5B9
                                                                                                                                                                                                                                                      SHA1:D315377FD1F651F363BA8A006FA050AB29991AF0
                                                                                                                                                                                                                                                      SHA-256:CB43174A854E808EB864A49B2C354A0722086D94DCDCE34F6F6E776F5089D07C
                                                                                                                                                                                                                                                      SHA-512:BFE833C198FA9AF71DAA26D85E568884FCC103BAD1446DB1A1B5614D1E0719B175574A55F83B974CB05AF9D789CB38839A358F4B766ADBE8D91DBECDF23AAA2C
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "pdf_de":["PDFs bearbeiten","Einfach","Kostenlos"].}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_labels.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):418
                                                                                                                                                                                                                                                      Entropy (8bit):4.446385973499709
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:46A179D67CC8FB8B37A7D9CD6D6C9AFA
                                                                                                                                                                                                                                                      SHA1:6957FC193324230B4C205283067FE2CD1664E45F
                                                                                                                                                                                                                                                      SHA-256:C1C05FFE107231855D0769C7A8F75A0967C4F1F0B02BF86F74D79C6B3DF6FF52
                                                                                                                                                                                                                                                      SHA-512:D4FEED841D601907C38A30B134857E7FF039348CECFFD495CCD32607E73A839FA40EE45D28553BCD8B4D3325CF878D60DED87AB420A81B98F3A825AEE2159493
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "yes_de":"Sim",. "yes_pt":"Instalando...",. "yes_es":"S.",. "yes_fr":"Oui",. "no_de":"NEIN",. "no_pt":"N.o",. "no_es":"No",. "no_fr":"Non",. "accept_de":"Akzeptieren und Installieren",. "accept_pt":"Aceitar e instalar",. "accept_es":"Aceptar e Instalar",. "accept_fr":"Accepter et Installer",. "cancel_de":"Stornieren",. "cancel_pt":"Cancelar",. "cancel_es":"Cancelar",. "cancel_fr":"Annuler".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_profile_description.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):272
                                                                                                                                                                                                                                                      Entropy (8bit):4.68911504845431
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:45906ED3BDAA905A521376AC08F022AA
                                                                                                                                                                                                                                                      SHA1:D0A1539DEC095BC931CDA64A9464596D9CCD79AB
                                                                                                                                                                                                                                                      SHA-256:690AF42EA919E877C7D456D36F17441049A69A7825296D210726C500202DD3D7
                                                                                                                                                                                                                                                      SHA-512:B0E08ED2708F354B9CA10CEFC29CD6B1DF74B12ED71DB1BCA76ED36084D539A2F4AC9C5F71DC139F66BB6FBA6561D88000CC0F36E29222132135EA568736667E
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "pdf_de":"PDF-Dateien kostenlos anzeigen, erstellen, verwalten und konvertieren! Installieren Sie OneLaunch, um .ber eine allgegenw.rtige Suchanwendung, die sich bequem oben auf Ihrem Desktop befindet, auf alle PDF-Funktionen zuzugreifen, die Sie ben.tigen.".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_profile_headline.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):64
                                                                                                                                                                                                                                                      Entropy (8bit):4.607258938909887
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:BC4A4D5AA3C2CA658E18FCC1AE4FFD4B
                                                                                                                                                                                                                                                      SHA1:D9020350E6B164B316CA62783C50D17150A485C4
                                                                                                                                                                                                                                                      SHA-256:46F7AC669F29E6FE3DDAD919637237CCAAAED48EE93CD5E6E88C9C11A561399B
                                                                                                                                                                                                                                                      SHA-512:0831D593EE49781D7B8F25EEDC46E55F024C74EC253A6B280A8D9E9857F3FBFA576BE79F9662734EA7E81EB0B29519C0296F2A1593622EAC0DEFEB5DB60573BF
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:{. "pdf_de":"Kostenlose PDF-Software - Einfach und kostenlos".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\is-AQF38.tmp\translations_stub_caption.json (copy)

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):101
                                                                                                                                                                                                                                                      Entropy (8bit):4.150882972285169
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:60123A55D6FC49B00468D7D57FAFA8B2
                                                                                                                                                                                                                                                      SHA1:5865BD3C61895006872C9C50B20C7AE64BB5852E
                                                                                                                                                                                                                                                      SHA-256:44C8AB3CA2C6998A559947EFD92969E119534EEDC940F5E12F4BE8C0296E727A
                                                                                                                                                                                                                                                      SHA-512:C7BC689F5F656F252A8A31C2FB84ED20A4EEF9CA574ECB63D1C17CC6B0997D075558A464996EB867FE2897911F7B091500E35E96F856979DB72A5B37F8418E52
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:.{. "de":"Vorbereiten",. "pt":"Preparando",. "es":"Preparando",. "fr":"En train de pr.parer".}

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shift.lnk

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 17:27:10 2024, mtime=Thu Oct 24 17:28:50 2024, atime=Wed Jul 24 00:20:10 2024, length=2255728, window=hide
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2236
                                                                                                                                                                                                                                                      Entropy (8bit):3.7411241412072664
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:4655363B1532DA6A1B8C7ECBCA052DFE
                                                                                                                                                                                                                                                      SHA1:4CF673E742734743A947732E34E52F866E1224E2
                                                                                                                                                                                                                                                      SHA-256:EAF62333571A6535871144E821D9184D7A95D1547C9D70E23077CB75E91061FC
                                                                                                                                                                                                                                                      SHA-512:A1204A8FC367B07C8EA499A7307D6A52C8129F58BBF2A1A8105A5BF8BD532EAD45C9DF59FBFCF326BB25B3343EA5D682A97B7ECBE8EBE8E0118BA6C76DF00877
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:L..................F.@.. ....k.VB&.....B&...A4.g...pk".......................:..DG..Yr?.D..U..k0.&...&........{.S...W..GB&......B&......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.XYY.....B......................A!.A.p.p.D.a.t.a...B.P.1.....XYa...Local.<......"S.XYc.....V.....................O...L.o.c.a.l.....P.1.....XY....Shift.<......XYa.XY......S.....................[..S.h.i.f.t.....Z.1.....XY....chromium..B......XYa.XY............................Z...c.h.r.o.m.i.u.m.....\.2.pk"..X.. .shift.exe.D......XYf.XYx....._.........................s.h.i.f.t...e.x.e.......e...............-.......d...........F........C:\Users\user\AppData\Local\Shift\chromium\shift.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.*.....\.....\.....\.....\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.,.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.6.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Shift.lnk

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 17:27:10 2024, mtime=Thu Oct 24 17:28:50 2024, atime=Wed Jul 24 00:20:10 2024, length=2255728, window=hide
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2271
                                                                                                                                                                                                                                                      Entropy (8bit):3.7811300520275957
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A24E5E61E0952263BA5381B95462CB66
                                                                                                                                                                                                                                                      SHA1:C709E88241556B44FAE922D9E8DE081159845595
                                                                                                                                                                                                                                                      SHA-256:90457C55B70CAE1CFB431C1F045383F5992AA5AE193D8190DC9ACF774001FA04
                                                                                                                                                                                                                                                      SHA-512:DFF8843126FE3E1BA37692C983DD5527FE4CFC68D5042617654EE4B32D5624602DC9029BD4B4EB982126D8D0E03D57B1EEF55D40327ACD56C16CBF1AF080E064
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:L..................F.@.. ....k.VB&..Mz..B&...A4.g...pk".......................:..DG..Yr?.D..U..k0.&...&........{.S...W..GB&......B&......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.XYY.....B......................A!.A.p.p.D.a.t.a...B.P.1.....XYa...Local.<......"S.XYc.....V.....................O...L.o.c.a.l.....P.1.....XY....Shift.<......XYa.XY......S.....................[..S.h.i.f.t.....Z.1.....XY....chromium..B......XYa.XY............................Z...c.h.r.o.m.i.u.m.....\.2.pk"..X.. .shift.exe.D......XYf.XYx....._.........................s.h.i.f.t...e.x.e.......e...............-.......d...........F........C:\Users\user\AppData\Local\Shift\chromium\shift.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.-.....\.....\.....\.....\.....\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.,.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.6.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shift.lnk

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 17:27:10 2024, mtime=Thu Oct 24 17:28:50 2024, atime=Wed Jul 24 00:20:10 2024, length=2255728, window=hide
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2271
                                                                                                                                                                                                                                                      Entropy (8bit):3.7811300520275957
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:A24E5E61E0952263BA5381B95462CB66
                                                                                                                                                                                                                                                      SHA1:C709E88241556B44FAE922D9E8DE081159845595
                                                                                                                                                                                                                                                      SHA-256:90457C55B70CAE1CFB431C1F045383F5992AA5AE193D8190DC9ACF774001FA04
                                                                                                                                                                                                                                                      SHA-512:DFF8843126FE3E1BA37692C983DD5527FE4CFC68D5042617654EE4B32D5624602DC9029BD4B4EB982126D8D0E03D57B1EEF55D40327ACD56C16CBF1AF080E064
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:L..................F.@.. ....k.VB&..Mz..B&...A4.g...pk".......................:..DG..Yr?.D..U..k0.&...&........{.S...W..GB&......B&......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.XYY.....B......................A!.A.p.p.D.a.t.a...B.P.1.....XYa...Local.<......"S.XYc.....V.....................O...L.o.c.a.l.....P.1.....XY....Shift.<......XYa.XY......S.....................[..S.h.i.f.t.....Z.1.....XY....chromium..B......XYa.XY............................Z...c.h.r.o.m.i.u.m.....\.2.pk"..X.. .shift.exe.D......XYf.XYx....._.........................s.h.i.f.t...e.x.e.......e...............-.......d...........F........C:\Users\user\AppData\Local\Shift\chromium\shift.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.-.....\.....\.....\.....\.....\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.,.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.6.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i

                                                                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Shift\Shift Browser.lnk

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 24 17:27:10 2024, mtime=Thu Oct 24 17:27:23 2024, atime=Wed Jul 24 00:20:10 2024, length=2255728, window=hide
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1237
                                                                                                                                                                                                                                                      Entropy (8bit):4.843471289942583
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:2051217AFA3D51202A262FDD0E0EB3FC
                                                                                                                                                                                                                                                      SHA1:643F0EC8CD82E1C3CD960E3ED9CF3DDE396D6F91
                                                                                                                                                                                                                                                      SHA-256:56AF02E16CC5B6D5F532C7285CC36A7BEB191ACF7197EABD4FE3F06723E25D9D
                                                                                                                                                                                                                                                      SHA-512:7017110021C74F3C639A5D43C8AC85036B89E4F5550761B240427036276EF7F32870D3998EA49FCD2DEC7105C5C77850433078F63B815FB7F11B689FAAE0F23F
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:L..................F.... ....k.VB&...+.^B&...A4.g...pk".......................:..DG..Yr?.D..U..k0.&...&........{.S...W..GB&..Ff.^B&......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.XYY.....B......................A!.A.p.p.D.a.t.a...B.P.1.....XYa...Local.<......"S.XYc.....V.....................O...L.o.c.a.l.....P.1.....XYf...Shift.<......XYa.XYl.....S.....................}...S.h.i.f.t.....Z.1.....XYf...chromium..B......XYa.XYf...........................tU..c.h.r.o.m.i.u.m.....\.2.pk"..X.. .shift.exe.D......XYf.XYf....._.........................s.h.i.f.t...e.x.e.......e...............-.......d...........F........C:\Users\user\AppData\Local\Shift\chromium\shift.exe..0.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.,.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.........|....I.J.H..K..:...`.......X.......123716..............n4UB.. .|..o%........E.P..#.....n4UB.

                                                                                                                                                                                                                                                      C:\Users\user\Desktop\Shift Browser.lnk

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Oct 24 17:27:10 2024, mtime=Thu Oct 24 17:27:10 2024, atime=Wed Jul 24 00:20:10 2024, length=2255728, window=hide
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):1223
                                                                                                                                                                                                                                                      Entropy (8bit):4.847141871758634
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:724289395843301324B268A76AD8168A
                                                                                                                                                                                                                                                      SHA1:6BCE1E3EEA8DDB6038784B92994BA3F3345799F3
                                                                                                                                                                                                                                                      SHA-256:157D0044DF85D56B978C7576529ED5C8D9C71B188C07C9F21C6519EFE2DE250D
                                                                                                                                                                                                                                                      SHA-512:FAE863C05800C1BB72A6D0B972501915C80B3819D8C147B40113364EB5830EA516CF6B551737000353640D45126E4D649B42D2B43845CF703047E0E4CD9E978D
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:L..................F.... ....k.VB&..f..VB&...A4.g...pk".......................:..DG..Yr?.D..U..k0.&...&........{.S...W..GB&..Ff.^B&......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.XYY.....B......................A!.A.p.p.D.a.t.a...B.P.1.....XYa...Local.<......"S.XYc.....V.....................O...L.o.c.a.l.....P.1.....XYa...Shift.<......XYa.XYa.....S.....................@&s.S.h.i.f.t.....Z.1.....XYf...chromium..B......XYa.XYf...........................tU..c.h.r.o.m.i.u.m.....\.2.pk"..X.. .shift.exe.D......XYf.XYf....._.........................s.h.i.f.t...e.x.e.......e...............-.......d...........F........C:\Users\user\AppData\Local\Shift\chromium\shift.exe..).....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.,.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.........|....I.J.H..K..:...`.......X.......123716..............n4UB.. .|..o%........E.P..#.....n4UB.. .|..o%......

                                                                                                                                                                                                                                                      C:\Users\user\Desktop\Shift.lnk

                                                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Thu Oct 24 17:27:10 2024, mtime=Thu Oct 24 17:27:46 2024, atime=Wed Jul 24 00:20:10 2024, length=2255728, window=hide
                                                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                                                      Size (bytes):2234
                                                                                                                                                                                                                                                      Entropy (8bit):3.737654034592062
                                                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                                                      SSDEEP:
                                                                                                                                                                                                                                                      MD5:3DCDAAF5C05E110527BC404A80EA7793
                                                                                                                                                                                                                                                      SHA1:E15A2AA4E15079940DF9475E683E01E1C2437648
                                                                                                                                                                                                                                                      SHA-256:0B2C503FA37DE430BE25BBDEA31A06183CAB5E906AF1DA883074671FA10312DF
                                                                                                                                                                                                                                                      SHA-512:6CC1977F3D90DAA1BEC5C9C80D9227D08082C905CD3607507D91DDFE9F889A66ADA387D8A7665ED8225BB8CC8008B7412734C2D2F7D06028BB60817E7EC71990
                                                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                                                      Preview:L..................F.@.. ....k.VB&....glB&...A4.g...pk".......................:..DG..Yr?.D..U..k0.&...&........{.S...W..GB&......B&......t...CFSF..1....."S...AppData...t.Y^...H.g.3..(.....gVA.G..k...@......"S.XYY.....B......................A!.A.p.p.D.a.t.a...B.P.1.....XYa...Local.<......"S.XYc.....V.....................O...L.o.c.a.l.....P.1.....XY....Shift.<......XYa.XY......S.....................[..S.h.i.f.t.....Z.1.....XY....chromium..B......XYa.XY.............................#..c.h.r.o.m.i.u.m.....\.2.pk"..X.. .shift.exe.D......XYf.XYx....._.........................s.h.i.f.t...e.x.e.......e...............-.......d...........F........C:\Users\user\AppData\Local\Shift\chromium\shift.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.).....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.\.s.h.i.f.t...e.x.e.,.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c.h.r.o.m.i.u.m.6.C.:.\.U.s.e.r.s.\.A.r.t.h.u.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.S.h.i.f.t.\.c

                                                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                      Entropy (8bit):7.999388546418438
                                                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 98.45%
                                                                                                                                                                                                                                                      • Inno Setup installer (109748/4) 1.08%
                                                                                                                                                                                                                                                      • Win32 EXE PECompact compressed (generic) (41571/9) 0.41%
                                                                                                                                                                                                                                                      • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                      File name:Shift Setup.exe
                                                                                                                                                                                                                                                      File size:96'211'664 bytes
                                                                                                                                                                                                                                                      MD5:0f0da32e4bde27b239dc562c4cc2ad1e
                                                                                                                                                                                                                                                      SHA1:872f2163447e8f73feb3d07cc09ead672b9f76b5
                                                                                                                                                                                                                                                      SHA256:416924d36d3b81e047ded649f18bf11999968278b46931824be5ecc9170a30ba
                                                                                                                                                                                                                                                      SHA512:36c2ffcf931661342e3254c917c638212bd98c27be9cb4ccc65bed338a30b5bbf12389ff0f05e0a08f50031f2d1111f8ae813b321648484650215b8691f5fb34
                                                                                                                                                                                                                                                      SSDEEP:1572864:4lseOKaVEe95QW6m58B0DzsIAzKatbIFG60r6oH6iJJzS0mxQyG0R:iseAVFzCnVIAuWIFGntaiJJzNmj
                                                                                                                                                                                                                                                      TLSH:D22833AFB32D623FCAAA56356433972494BBBA5494538C0F63F4060DC75B4700F3AE69
                                                                                                                                                                                                                                                      File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                                                      Icon Hash:07270e1c38111b8f

                                                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Entrypoint:0x4b5eec
                                                                                                                                                                                                                                                      Entrypoint Section:.itext
                                                                                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                                                                                                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                                      Time Stamp:0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
                                                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                                                      OS Version Major:6
                                                                                                                                                                                                                                                      OS Version Minor:1
                                                                                                                                                                                                                                                      File Version Major:6
                                                                                                                                                                                                                                                      File Version Minor:1
                                                                                                                                                                                                                                                      Subsystem Version Major:6
                                                                                                                                                                                                                                                      Subsystem Version Minor:1
                                                                                                                                                                                                                                                      Import Hash:e569e6f445d32ba23766ad67d1e3787f

                                                                                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                                                                                      Signature Issuer:CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
                                                                                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                                                                                      • 11/05/2023 11:36:55 24/04/2026 17:16:53
                                                                                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                                                                                      • OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.1.3.6.1.4.1.311.60.2.1.2=British Columbia, OID.2.5.4.15=Private Organization, CN=Shift Technologies Inc., SERIALNUMBER=BC1191266, O=Shift (Shift Technologies Inc.), L=Victoria, S=British Columbia, C=CA
                                                                                                                                                                                                                                                      Version:3
                                                                                                                                                                                                                                                      Thumbprint MD5:11C502D9A1CA5ABB3AA172147439527F
                                                                                                                                                                                                                                                      Thumbprint SHA-1:355FEF4F77C8B4CEEABABACF91834240A8D76435
                                                                                                                                                                                                                                                      Thumbprint SHA-256:74AB22CFEFD4D99509F937DD200C2734DB8BBC73EFE97F1805DC8148A7B2A231
                                                                                                                                                                                                                                                      Serial:3A9AEC951A144C96B362584F2535C97A

                                                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                                      mov ebp, esp
                                                                                                                                                                                                                                                      add esp, FFFFFFA4h
                                                                                                                                                                                                                                                      push ebx
                                                                                                                                                                                                                                                      push esi
                                                                                                                                                                                                                                                      push edi
                                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-3Ch], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-40h], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-5Ch], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-30h], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-38h], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-34h], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-2Ch], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-28h], eax
                                                                                                                                                                                                                                                      mov dword ptr [ebp-14h], eax
                                                                                                                                                                                                                                                      mov eax, 004B14B8h
                                                                                                                                                                                                                                                      call 00007FEB5CBCF4B5h
                                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                                      push 004B65E2h
                                                                                                                                                                                                                                                      push dword ptr fs:[eax]
                                                                                                                                                                                                                                                      mov dword ptr fs:[eax], esp
                                                                                                                                                                                                                                                      xor edx, edx
                                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                                      push 004B659Eh
                                                                                                                                                                                                                                                      push dword ptr fs:[edx]
                                                                                                                                                                                                                                                      mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                                                      mov eax, dword ptr [004BE634h]
                                                                                                                                                                                                                                                      call 00007FEB5CC71FA7h
                                                                                                                                                                                                                                                      call 00007FEB5CC71AFAh
                                                                                                                                                                                                                                                      lea edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                                                      call 00007FEB5CBE4F54h
                                                                                                                                                                                                                                                      mov edx, dword ptr [ebp-14h]
                                                                                                                                                                                                                                                      mov eax, 004C1D84h
                                                                                                                                                                                                                                                      call 00007FEB5CBCA0A7h
                                                                                                                                                                                                                                                      push 00000002h
                                                                                                                                                                                                                                                      push 00000000h
                                                                                                                                                                                                                                                      push 00000001h
                                                                                                                                                                                                                                                      mov ecx, dword ptr [004C1D84h]
                                                                                                                                                                                                                                                      mov dl, 01h
                                                                                                                                                                                                                                                      mov eax, dword ptr [004238ECh]
                                                                                                                                                                                                                                                      call 00007FEB5CBE60D7h
                                                                                                                                                                                                                                                      mov dword ptr [004C1D88h], eax
                                                                                                                                                                                                                                                      xor edx, edx
                                                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                                                      push 004B654Ah
                                                                                                                                                                                                                                                      push dword ptr fs:[edx]
                                                                                                                                                                                                                                                      mov dword ptr fs:[edx], esp
                                                                                                                                                                                                                                                      call 00007FEB5CC7202Fh
                                                                                                                                                                                                                                                      mov dword ptr [004C1D90h], eax
                                                                                                                                                                                                                                                      mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                                                                      cmp dword ptr [eax+0Ch], 01h
                                                                                                                                                                                                                                                      jne 00007FEB5CC7824Ah
                                                                                                                                                                                                                                                      mov eax, dword ptr [004C1D90h]
                                                                                                                                                                                                                                                      mov edx, 00000028h
                                                                                                                                                                                                                                                      call 00007FEB5CBE69CCh
                                                                                                                                                                                                                                                      mov edx, dword ptr [004C1D90h]

                                                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0xc40000x9a.edata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xc20000xfdc.idata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x62160.rsrc
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x5bbf9600x1970
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0xc60000x18.rdata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0xc22f40x254.idata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0xc30000x1a4.didata
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                      .text0x10000xb39e40xb3a0043af0a9476ca224d8e8461f1e22c94daFalse0.34525867693110646data6.357635049994181IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .itext0xb50000x16880x1800185e04b9a1f554e31f7f848515dc890cFalse0.54443359375data5.971425428435973IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .data0xb70000x37a40x3800cab2107c933b696aa5cf0cc6c3fd3980False0.36097935267857145data5.048648594372454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .bss0xbb0000x6de80x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .idata0xc20000xfdc0x1000e7d1635e2624b124cfdce6c360ac21cdFalse0.3798828125data5.029087481102678IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .didata0xc30000x1a40x2008ced971d8a7705c98b173e255d8c9aa7False0.345703125data2.7509822285969876IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .edata0xc40000x9a0x2008d4e1e508031afe235bf121c80fd7d5fFalse0.2578125data1.877162954504408IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .tls0xc50000x180x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                      .rdata0xc60000x5d0x2008f2f090acd9622c88a6a852e72f94e96False0.189453125data1.3838943752217987IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                      .rsrc0xc70000x621600x62200388bad3c805b7fe52c4c3e51ab849fcfFalse0.823499701433121data7.688952401448436IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                      RT_ICON0xc75280x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.7916666666666666
                                                                                                                                                                                                                                                      RT_ICON0xc79900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.6024859287054409
                                                                                                                                                                                                                                                      RT_ICON0xc8a380x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.3980869154463864
                                                                                                                                                                                                                                                      RT_ICON0xccc600x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584EnglishUnited States0.26005560156157576
                                                                                                                                                                                                                                                      RT_ICON0xdd4880xf124PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States1.0004211754033565
                                                                                                                                                                                                                                                      RT_ICON0xec5ac0x39bc1PNG image data, 512 x 512, 8-bit/color RGBA, non-interlacedEnglishUnited States1.00034252223223
                                                                                                                                                                                                                                                      RT_STRING0x1261700x360data0.34375
                                                                                                                                                                                                                                                      RT_STRING0x1264d00x260data0.3256578947368421
                                                                                                                                                                                                                                                      RT_STRING0x1267300x45cdata0.4068100358422939
                                                                                                                                                                                                                                                      RT_STRING0x126b8c0x40cdata0.3754826254826255
                                                                                                                                                                                                                                                      RT_STRING0x126f980x2d4data0.39226519337016574
                                                                                                                                                                                                                                                      RT_STRING0x12726c0xb8data0.6467391304347826
                                                                                                                                                                                                                                                      RT_STRING0x1273240x9cdata0.6410256410256411
                                                                                                                                                                                                                                                      RT_STRING0x1273c00x374data0.4230769230769231
                                                                                                                                                                                                                                                      RT_STRING0x1277340x398data0.3358695652173913
                                                                                                                                                                                                                                                      RT_STRING0x127acc0x368data0.3795871559633027
                                                                                                                                                                                                                                                      RT_STRING0x127e340x2a4data0.4275147928994083
                                                                                                                                                                                                                                                      RT_RCDATA0x1280d80x10data1.5
                                                                                                                                                                                                                                                      RT_RCDATA0x1280e80x2c4data0.6384180790960452
                                                                                                                                                                                                                                                      RT_RCDATA0x1283ac0x2cdata1.25
                                                                                                                                                                                                                                                      RT_GROUP_ICON0x1283d80x5adataEnglishUnited States0.7777777777777778
                                                                                                                                                                                                                                                      RT_VERSION0x1284340x584dataEnglishUnited States0.28611898016997167
                                                                                                                                                                                                                                                      RT_MANIFEST0x1289b80x7a8XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.3377551020408163

                                                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                                                      kernel32.dllGetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
                                                                                                                                                                                                                                                      comctl32.dllInitCommonControls
                                                                                                                                                                                                                                                      version.dllGetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
                                                                                                                                                                                                                                                      user32.dllCreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
                                                                                                                                                                                                                                                      oleaut32.dllSysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
                                                                                                                                                                                                                                                      netapi32.dllNetWkstaGetInfo, NetApiBufferFree
                                                                                                                                                                                                                                                      advapi32.dllConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

                                                                                                                                                                                                                                                      Exports

                                                                                                                                                                                                                                                      NameOrdinalAddress
                                                                                                                                                                                                                                                      TMethodImplementationIntercept30x4541a8
                                                                                                                                                                                                                                                      __dbk_fcall_wrapper20x40d0a0
                                                                                                                                                                                                                                                      dbkFCallWrapperAddr10x4be63c

                                                                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                                                      ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                                                      Start time:14:26:51
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\Shift Setup.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\Shift Setup.exe"
                                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                                      File size:96'211'664 bytes
                                                                                                                                                                                                                                                      MD5 hash:0F0DA32E4BDE27B239DC562C4CC2AD1E
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:Borland Delphi
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                                                                                      Start time:14:26:51
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp
                                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\is-163NS.tmp\Shift Setup.tmp" /SL5="$10468,95019598,1164800,C:\Users\user\Desktop\Shift Setup.exe"
                                                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                                                      File size:3'501'056 bytes
                                                                                                                                                                                                                                                      MD5 hash:DD387924C262802D2BDFB7C7201E3DF5
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:Borland Delphi
                                                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                                                                      Start time:14:27:00
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                                      Commandline:"C:\Windows\System32\taskkill.exe" /f /im shift.exe
                                                                                                                                                                                                                                                      Imagebase:0x20000
                                                                                                                                                                                                                                                      File size:74'240 bytes
                                                                                                                                                                                                                                                      MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                                                      Start time:14:27:00
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      Imagebase:0x7ff71e790000
                                                                                                                                                                                                                                                      File size:875'008 bytes
                                                                                                                                                                                                                                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                                                                                      Start time:14:27:23
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\schtasks.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"schtasks" /delete /tn ShiftLaunchTask /f
                                                                                                                                                                                                                                                      Imagebase:0x7ff759df0000
                                                                                                                                                                                                                                                      File size:235'008 bytes
                                                                                                                                                                                                                                                      MD5 hash:796B784E98008854C27F4B18D287BA30
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:6
                                                                                                                                                                                                                                                      Start time:14:27:23
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                      Imagebase:0x7ff71e790000
                                                                                                                                                                                                                                                      File size:875'008 bytes
                                                                                                                                                                                                                                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:7
                                                                                                                                                                                                                                                      Start time:14:27:24
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --start-maximized
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                                                                      Start time:14:27:24
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0xf4,0xf8,0xfc,0xac,0x100,0x7ffe3ec55700,0x7ffe3ec5570c,0x7ffe3ec55718
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                                                                      Start time:14:27:24
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Shift\chromium\shift.exe --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Shift\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=122.10.0.1101 --initial-client-data=0x154,0x158,0x15c,0x114,0x160,0x7ff678faf0b8,0x7ff678faf0c4,0x7ff678faf0d0
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                                                      Start time:14:27:25
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2312 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:11
                                                                                                                                                                                                                                                      Start time:14:27:26
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --start-stack-profiler --mojo-platform-channel-handle=2864 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:3
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:12
                                                                                                                                                                                                                                                      Start time:14:27:26
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --mojo-platform-channel-handle=3184 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                                                                                      Start time:14:27:26
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --mojo-platform-channel-handle=4328 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                                                                                      Start time:14:27:27
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --extension-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538271629 --mojo-platform-channel-handle=4508 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:2
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                                                                                      Start time:14:27:27
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538611283 --mojo-platform-channel-handle=4884 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                                                                                      Start time:14:27:27
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Windows\Explorer.EXE
                                                                                                                                                                                                                                                      Imagebase:0x7ff63cd30000
                                                                                                                                                                                                                                                      File size:4'849'904 bytes
                                                                                                                                                                                                                                                      MD5 hash:5EA66FF5AE5612F921BC9DA23BAC95F7
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:17
                                                                                                                                                                                                                                                      Start time:14:27:27
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --instant-process --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=538993971 --mojo-platform-channel-handle=5240 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:18
                                                                                                                                                                                                                                                      Start time:14:27:28
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=539522401 --mojo-platform-channel-handle=5548 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:19
                                                                                                                                                                                                                                                      Start time:14:27:28
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Shift\chromium\shift.exe --start-maximized --launch-source=sign-in
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:22
                                                                                                                                                                                                                                                      Start time:14:27:29
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                                      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2700
                                                                                                                                                                                                                                                      Imagebase:0x450000
                                                                                                                                                                                                                                                      File size:482'640 bytes
                                                                                                                                                                                                                                                      MD5 hash:40A149513D721F096DDF50C04DA2F01F
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:23
                                                                                                                                                                                                                                                      Start time:14:27:34
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=545806341 --mojo-platform-channel-handle=6208 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:25
                                                                                                                                                                                                                                                      Start time:14:27:38
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:26
                                                                                                                                                                                                                                                      Start time:14:27:42
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=renderer --no-pre-read-main-dll --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1729793908742888 --launch-time-ticks=553237658 --mojo-platform-channel-handle=6480 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:1
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:27
                                                                                                                                                                                                                                                      Start time:14:27:46
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --launch-source=sign-in
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:28
                                                                                                                                                                                                                                                      Start time:14:27:46
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --no-pre-read-main-dll --mojo-platform-channel-handle=6992 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:32
                                                                                                                                                                                                                                                      Start time:14:28:02
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                                                      Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 8548 -s 2444
                                                                                                                                                                                                                                                      Imagebase:0x450000
                                                                                                                                                                                                                                                      File size:482'640 bytes
                                                                                                                                                                                                                                                      MD5 hash:40A149513D721F096DDF50C04DA2F01F
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:33
                                                                                                                                                                                                                                                      Start time:14:28:14
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:setup.exe --do-not-launch-chrome
                                                                                                                                                                                                                                                      Imagebase:0x7ff7e56a0000
                                                                                                                                                                                                                                                      File size:2'823'680 bytes
                                                                                                                                                                                                                                                      MD5 hash:1D06621473A8216A98687546A595EC5D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:34
                                                                                                                                                                                                                                                      Start time:14:28:14
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
                                                                                                                                                                                                                                                      Imagebase:0x7ff7e56a0000
                                                                                                                                                                                                                                                      File size:2'823'680 bytes
                                                                                                                                                                                                                                                      MD5 hash:1D06621473A8216A98687546A595EC5D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:36
                                                                                                                                                                                                                                                      Start time:14:28:50
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
                                                                                                                                                                                                                                                      Imagebase:0x7ff7e56a0000
                                                                                                                                                                                                                                                      File size:2'823'680 bytes
                                                                                                                                                                                                                                                      MD5 hash:1D06621473A8216A98687546A595EC5D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:38
                                                                                                                                                                                                                                                      Start time:14:28:50
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:C:\Users\user\AppData\Local\Shift\chromium\122.10.0.1101\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Shift\User Data\Crashpad" --url=https://o1334372.ingest.sentry.io/api/4506193009180672/minidump/?sentry_key=1c60a0cacdead91f905faa80e9c82d03 --annotation=plat=Win64 --annotation=prod=Shift --annotation=ver=127.2.2.1372 --initial-client-data=0x24c,0x250,0x254,0x208,0x258,0x7ff7e5908410,0x7ff7e590841c,0x7ff7e5908428
                                                                                                                                                                                                                                                      Imagebase:0x7ff7e56a0000
                                                                                                                                                                                                                                                      File size:2'823'680 bytes
                                                                                                                                                                                                                                                      MD5 hash:1D06621473A8216A98687546A595EC5D
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      General

                                                                                                                                                                                                                                                      Target ID:40
                                                                                                                                                                                                                                                      Start time:14:29:25
                                                                                                                                                                                                                                                      Start date:24/10/2024
                                                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Shift\chromium\shift.exe
                                                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Shift\chromium\shift.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=32902 --gpu-device-id=16024 --gpu-sub-system-id=1050155081 --gpu-revision=2 --gpu-driver-version=27.20.100.9415 --no-pre-read-main-dll --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=464 --field-trial-handle=2316,i,1528229121420869287,13748701593454551628,262144 --variations-seed-version /prefetch:8
                                                                                                                                                                                                                                                      Imagebase:0x7ff678dd0000
                                                                                                                                                                                                                                                      File size:2'255'728 bytes
                                                                                                                                                                                                                                                      MD5 hash:57FF3A035DA210EAF2B467E8DB148635
                                                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF678F23034 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction ID: 439c6ad7ad2c74e4a833b8c3f881a943a98c8a34eed6760094fbba1b9a72361c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0113636B24B458AEB00CF71E8452A837A4FB187A8F140E31DA6D877A4DF3CD5A88344
                                                                                                                                                                                                                                                        Function 00007FF678DDB180 Relevance: .6, Instructions: 646COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 44b6302aede2dd13ff882eb9c1be377701c721944b08f923b62188f15a2c4496
                                                                                                                                                                                                                                                        • Instruction ID: ee0917d9d506d8c946ce4b289061b220822c4934c273434827dbf18e99a43d4b
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44b6302aede2dd13ff882eb9c1be377701c721944b08f923b62188f15a2c4496
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57324C770B86004BD31FCE2ED99158AB292F744AA2709F238FE57C7B44E67CEE158604
                                                                                                                                                                                                                                                        Function 00007FFE3EB4B180 Relevance: .6, Instructions: 646COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 44b6302aede2dd13ff882eb9c1be377701c721944b08f923b62188f15a2c4496
                                                                                                                                                                                                                                                        • Instruction ID: baebc28696e8d399af62577463130487ec12c0ecce7b82b7e7905eef0e3d089d
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44b6302aede2dd13ff882eb9c1be377701c721944b08f923b62188f15a2c4496
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C324C770B86004BD31FCE2ED99158AB292F744AA2709F238FE57C7B54E67CEE158604
                                                                                                                                                                                                                                                        Function 00007FF678DD5C60 Relevance: .6, Instructions: 591COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 0ad987277e8095284215c95a372eb5f6cf80c1776cf31727849157876eab2a9f
                                                                                                                                                                                                                                                        • Instruction ID: 0c378f2598257759f0b0f42f298db464b6ce74e241f18c37b27bfb87db6b5928
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ad987277e8095284215c95a372eb5f6cf80c1776cf31727849157876eab2a9f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F03268B6B90A6596DB048F16E90178D7B64F319BC8F998526DF8C83B54EF38E871C340
                                                                                                                                                                                                                                                        Function 00007FFE3EB45C60 Relevance: .6, Instructions: 591COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 0ad987277e8095284215c95a372eb5f6cf80c1776cf31727849157876eab2a9f
                                                                                                                                                                                                                                                        • Instruction ID: d2a5bb051f763e390472d7f9b64e116b14805403abf74c330a2f65a6e43c1dc3
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0ad987277e8095284215c95a372eb5f6cf80c1776cf31727849157876eab2a9f
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A03268B6B90B65A6DB048F16E94178D7B64F319BC8F898526DF8C83B54EB38E471D300
                                                                                                                                                                                                                                                        Function 00007FF678DD275E Relevance: .6, Instructions: 567COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: a5c173e69979083e2a7fd722a68a15f6219265641d256227c612c7dca03fa96e
                                                                                                                                                                                                                                                        • Instruction ID: cfed17c6ed802f3ac2f65c680cfdcd525534cae058ddeb80dc0b41e9170dafa2
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a5c173e69979083e2a7fd722a68a15f6219265641d256227c612c7dca03fa96e
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 90329422D18FDA52E6234739D4035B56710EFB7B88F10E717FEC872992EF75A9899200
                                                                                                                                                                                                                                                        Function 00007FFE3EB4275E Relevance: .6, Instructions: 567COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 52e4b2f74c786058a7b5a55cb887583faef1674f4e7de3ff9400ea0cc549cfe1
                                                                                                                                                                                                                                                        • Instruction ID: 73d3e755b844d46ec914e53b72fa7bfe6fcc71273644cb22f195171e0ecd9df1
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 52e4b2f74c786058a7b5a55cb887583faef1674f4e7de3ff9400ea0cc549cfe1
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71327412D08F9A52E6334B39D4076B56710EFB7B88F00E717BFD8715A2DF75A989A200
                                                                                                                                                                                                                                                        Function 00007FF678DDBF00 Relevance: .3, Instructions: 341COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 9b23cb843aad94d1298dfd3a241682c47dd6c72d38c050d38090c036d95a7f10
                                                                                                                                                                                                                                                        • Instruction ID: 4ce12eddc364caab976ab511a59012e12624b228ccc19f2454d58685f8e9d91f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9b23cb843aad94d1298dfd3a241682c47dd6c72d38c050d38090c036d95a7f10
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EAD1AD9BC28FD945F313533D54436A2E610AFFB5E8A20E303FDF471A62EB50B6956224
                                                                                                                                                                                                                                                        Function 00007FFE3EB4BF00 Relevance: .3, Instructions: 341COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: c966031b6ced4e889966bf5309e51e08a4a349b65604b1124724bccb7bebe35d
                                                                                                                                                                                                                                                        • Instruction ID: e5d9f5be174c3f96826b468ffb84d8dc5f8acc91b87993c188145e1f26772581
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c966031b6ced4e889966bf5309e51e08a4a349b65604b1124724bccb7bebe35d
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 92D1AD9BC18FD945F313573D54476A2E610AFF76D8A20E303FDF471A62EB50B2956220
                                                                                                                                                                                                                                                        Function 00007FF678DD1760 Relevance: .3, Instructions: 310COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: daf0e0dfe6573bd52038698bb5992c6f245c2f2e0251e08476892236e289c43a
                                                                                                                                                                                                                                                        • Instruction ID: 1dac3f7f3ec003a97ce06017398412f404982383f27d1e55cbae55e5627b5e96
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: daf0e0dfe6573bd52038698bb5992c6f245c2f2e0251e08476892236e289c43a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9DF12E13D2CFC583E6214B3996012BAA720FBB5348F11F715EFD922962DF28F6E59210
                                                                                                                                                                                                                                                        Function 00007FFE3EB41760 Relevance: .3, Instructions: 310COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: daf0e0dfe6573bd52038698bb5992c6f245c2f2e0251e08476892236e289c43a
                                                                                                                                                                                                                                                        • Instruction ID: 29522cb35f507b76ca31613651a76bdc78e092e14d1689e2899a5e983dd46c31
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: daf0e0dfe6573bd52038698bb5992c6f245c2f2e0251e08476892236e289c43a
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1F10C12D1CFC593E6364F3996052BA6720FBB5748F01E715EFD922962DF28F2E5A200
                                                                                                                                                                                                                                                        Function 00007FF678DD3260 Relevance: .2, Instructions: 236COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 3b79603d03c4492a183ea9e68cc3fefeb8df78c07f00ad3340cb026821379f68
                                                                                                                                                                                                                                                        • Instruction ID: 352aac871c32ac04197a4d2a824e1f0a750696e7a6cf1ca405e732b2a552fa0e
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b79603d03c4492a183ea9e68cc3fefeb8df78c07f00ad3340cb026821379f68
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5B18E62C2DF8111F71B3B3544132649A305FA2298F70C733FDA9B59A6EF99BA8C5124
                                                                                                                                                                                                                                                        Function 00007FFE3EB43260 Relevance: .2, Instructions: 236COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: faa94c90d21f79a4ddd5de20bb2ae7de96e395314a359dd0dc536a4ef9383263
                                                                                                                                                                                                                                                        • Instruction ID: 7cd87cb225445ac6fde74966abf149a16bb071e569e77ccadd094117564757cc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: faa94c90d21f79a4ddd5de20bb2ae7de96e395314a359dd0dc536a4ef9383263
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3B18161C0DB8201F7273B35045B2689A305FA2B94F94C732FEE9719B7DF29B64C6122
                                                                                                                                                                                                                                                        Function 00007FF678DDA820 Relevance: .2, Instructions: 191COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 943d49a28179acb6b17e54598dc5f3c7297a0172a48014cdfa5047513f315c58
                                                                                                                                                                                                                                                        • Instruction ID: 42858ce704e87d82e7337dbb5c1b4504bf1351e8323591d66745dc42e29d66d4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 943d49a28179acb6b17e54598dc5f3c7297a0172a48014cdfa5047513f315c58
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A86107E6F50F9883DB548B9EA402B886760F719FC5F55511AEE2C67301EA3DE9A3C340
                                                                                                                                                                                                                                                        Function 00007FFE3EB4A820 Relevance: .2, Instructions: 191COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 943d49a28179acb6b17e54598dc5f3c7297a0172a48014cdfa5047513f315c58
                                                                                                                                                                                                                                                        • Instruction ID: 42858ce704e87d82e7337dbb5c1b4504bf1351e8323591d66745dc42e29d66d4
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 943d49a28179acb6b17e54598dc5f3c7297a0172a48014cdfa5047513f315c58
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A86107E6F50F9883DB548B9EA402B886760F719FC5F55511AEE2C67301EA3DE9A3C340
                                                                                                                                                                                                                                                        Function 00007FF678DDAAE0 Relevance: .2, Instructions: 152COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 0d6523ba8e4505282c919c1d35e15f27044c6a44fab965eb172d8ea98f7d2704
                                                                                                                                                                                                                                                        • Instruction ID: da7cff74ec7fdd3f23c44029e7e5cb4f6e3f0f44d058c844f84f206ffc1f1dbc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0d6523ba8e4505282c919c1d35e15f27044c6a44fab965eb172d8ea98f7d2704
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA51BAF3B62B9485D7918FA9E444BC837A8F329F95F215115EB4C6B351DB328A62C301
                                                                                                                                                                                                                                                        Function 00007FFE3EB4AAE0 Relevance: .2, Instructions: 152COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 0d6523ba8e4505282c919c1d35e15f27044c6a44fab965eb172d8ea98f7d2704
                                                                                                                                                                                                                                                        • Instruction ID: da7cff74ec7fdd3f23c44029e7e5cb4f6e3f0f44d058c844f84f206ffc1f1dbc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0d6523ba8e4505282c919c1d35e15f27044c6a44fab965eb172d8ea98f7d2704
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA51BAF3B62B9485D7918FA9E444BC837A8F329F95F215115EB4C6B351DB328A62C301
                                                                                                                                                                                                                                                        Function 00007FF678DDBBC0 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: cc164fb7218ceaae39abdac0ddd3f2c277f5bcc766a5f58e04bcc091dc818886
                                                                                                                                                                                                                                                        • Instruction ID: aebbacac3cf93319eba9430b94beae02c08f3d607ea3237adeb6863a8672f9d6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc164fb7218ceaae39abdac0ddd3f2c277f5bcc766a5f58e04bcc091dc818886
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6541E5EAC29FB945E723A33A6D43286D9009EF7589550E303FCB439E65F701B5D13224
                                                                                                                                                                                                                                                        Function 00007FFE3EB4BBC0 Relevance: .1, Instructions: 136COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 311130c4530c45659cdeabc72014c0afeca91dbfb96ccffb836939b70e973a55
                                                                                                                                                                                                                                                        • Instruction ID: 69d9ed282f8a178f38c9edbcd4d13ff6a1704687194df171cf9bde032a30467a
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 311130c4530c45659cdeabc72014c0afeca91dbfb96ccffb836939b70e973a55
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E741E3EAC29FA945E723A33A6D43286DA009EF7989550E307FCB439E65F701B4D13224
                                                                                                                                                                                                                                                        Function 00007FF678DD3B60 Relevance: .1, Instructions: 125COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: d38faa538316b59c3faf2c439a5e4848b15f66bf3988c877533d8a96204a9f93
                                                                                                                                                                                                                                                        • Instruction ID: 53e0856149e0e16ce9ff23c877f4945863af12229dd50395df3c43e7d5443ebe
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d38faa538316b59c3faf2c439a5e4848b15f66bf3988c877533d8a96204a9f93
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4541D12AE2CFD721F31387396403636E6005FF7195A91E72FFCE4B1862EB6557816228
                                                                                                                                                                                                                                                        Function 00007FFE3EB43B60 Relevance: .1, Instructions: 125COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 5244dc878745c056e4a251b256ac713b515a634e5b81e2171cf67e4d2a13ce83
                                                                                                                                                                                                                                                        • Instruction ID: 8a3c73dd024ff9a11a1ce01befe2fd695a478c219c5c830447f03759758978ba
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5244dc878745c056e4a251b256ac713b515a634e5b81e2171cf67e4d2a13ce83
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC41212AE2CFD721F31383392407636E6006FF7595A81EB2FBCE4B1962EB6453416218
                                                                                                                                                                                                                                                        Function 00007FF678DD3DF0 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 84c51d8329543f0a3793c8b1844613dbf1e7c38041e6c6d1f056df207f663aec
                                                                                                                                                                                                                                                        • Instruction ID: d99bf1ab880e289cfe8433fbbc3030aa0c1fd730e7adac68f2c3c4f0067d9cd6
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 84c51d8329543f0a3793c8b1844613dbf1e7c38041e6c6d1f056df207f663aec
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4E31682AC3DFD751F713873E5407525DA14AFF3285A90E31BF9A831822FB159781A318
                                                                                                                                                                                                                                                        Function 00007FFE3EB43DF0 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 259c209462cf914fcc1a9513ef061fa138efd8313a667dc6e13a94e71429e823
                                                                                                                                                                                                                                                        • Instruction ID: 2d0213781f1b564d1b056278b8ba4a0e174d92e4484abe536548d1d4886f449f
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 259c209462cf914fcc1a9513ef061fa138efd8313a667dc6e13a94e71429e823
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8531592AC2DFD751F713873E6407515DA14AFF3685A90E31FBAE835822FB119745A304
                                                                                                                                                                                                                                                        Function 00007FF678DD3F90 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 8d1ce8b13054c83c164a58169692468bbdde5484ba859c71095d4737e7d20bb2
                                                                                                                                                                                                                                                        • Instruction ID: fae9ff95257e57a000155ea38914741cb5f47a895c9bd8becac57bdf5302d0bc
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d1ce8b13054c83c164a58169692468bbdde5484ba859c71095d4737e7d20bb2
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 70317223C7DB4781F2022778640A6B99E126F62354F30D3B3F55CB6492EF1C2D986968
                                                                                                                                                                                                                                                        Function 00007FFE3EB43F90 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 5d90c9423458a293eb774a031ff1f22e0228d1b090268ca7eaea419213403872
                                                                                                                                                                                                                                                        • Instruction ID: 287a7e6da696327d6ad4b9530a4aeb1ed5c529a0c5c2b5687cddc5e24e148d75
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5d90c9423458a293eb774a031ff1f22e0228d1b090268ca7eaea419213403872
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47311951C19B9341F2232F78640A2BA9E106FA2B54F40D732E9DC365B3DF1C29B87942
                                                                                                                                                                                                                                                        Function 00007FF678DD3A00 Relevance: .1, Instructions: 71COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: fa119f75bb20eb19ca57b54508f079e08dc6b0e2906aca5d03b0af8a46b41c73
                                                                                                                                                                                                                                                        • Instruction ID: be2d8c1513452924dd044c594bbfb672cfe3a43a5de131e86d0ab8453dcd3171
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fa119f75bb20eb19ca57b54508f079e08dc6b0e2906aca5d03b0af8a46b41c73
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E521062AD3DFEB51F613873E6407515DA009FF3285AA0E71FFDA435C62EB5547806228
                                                                                                                                                                                                                                                        Function 00007FFE3EB43A00 Relevance: .1, Instructions: 71COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: fe1b4087038f6014ee49058e4569c09dd3d143c1e7c1cafad88f73902cd30613
                                                                                                                                                                                                                                                        • Instruction ID: 8ca3a7bfc0ebba1c14e804620b764e68bb16f458cd2c99e1aabbdef1f9b96114
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fe1b4087038f6014ee49058e4569c09dd3d143c1e7c1cafad88f73902cd30613
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E121482AC2DFDB51F713873E6407119DA00AFF3685A90E71FBDE434D62E71157806218
                                                                                                                                                                                                                                                        Function 00007FF678DDBE32 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363051252.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363004681.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363431346.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363521939.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363567773.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363612599.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363658876.00007FF678FAD000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363758040.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363810487.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: 79c641ff6a0aa3704f2d008476aac3a527b967efc1cc62e0bbfd1961035cfd1c
                                                                                                                                                                                                                                                        • Instruction ID: 174b0a788695e6a2b8f82056d63e9c969e5ea3d78634073e15e3efcb4a6cb1e3
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 79c641ff6a0aa3704f2d008476aac3a527b967efc1cc62e0bbfd1961035cfd1c
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C0146EAC24FBA42E723A3396943282D910AEF3588120E307FDF434E15F301B6D07220
                                                                                                                                                                                                                                                        Function 00007FFE3EB4BE32 Relevance: .0, Instructions: 43COMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                                                        • Opcode ID: a862c7be0fb7b3e0dfbdfd3c6c36b64d88e975a857352134e83b6bd9a1b8dba6
                                                                                                                                                                                                                                                        • Instruction ID: 27a39f0e666c41fa84cb9d1f4f2fca6c82d4b286472b905d766e57719f5d1525
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a862c7be0fb7b3e0dfbdfd3c6c36b64d88e975a857352134e83b6bd9a1b8dba6
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F0146EAC25FBA46E723A3396943286D910AEF3588120E307FDF434E15F705B5D07225
                                                                                                                                                                                                                                                        Function 00007FFE3EBDE0D0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000008.00000002.5363949251.00007FFE3EB41000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFE3EB40000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5363905478.00007FFE3EB40000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364167785.00007FFE3EC14000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364248189.00007FFE3EC43000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364290566.00007FFE3EC44000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364333827.00007FFE3EC45000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364378066.00007FFE3EC51000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC5C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364427406.00007FFE3EC66000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000008.00000002.5364528443.00007FFE3EC6C000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_8_2_7ffe3eb40000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 4bc3fc8a46b871c3250602429a10daeeba676ff5ace792fc5e714b7c06c4f5f8
                                                                                                                                                                                                                                                        • Instruction ID: b92c3aed099abbaefd61a4cbce160e5ae20aa1fc8a76f1ccb04a5ad7d02c51b3
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4bc3fc8a46b871c3250602429a10daeeba676ff5ace792fc5e714b7c06c4f5f8
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60118F22B14B458AEB00CF60E8482A933A0FB48B58F400A30DA6D46764DF3CD158D740

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF678F23034 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000009.00000002.5358764192.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5358717814.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359177756.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359269274.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359314112.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359359647.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359406892.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359459318.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000009.00000002.5359514013.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_9_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction ID: 439c6ad7ad2c74e4a833b8c3f881a943a98c8a34eed6760094fbba1b9a72361c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0113636B24B458AEB00CF71E8452A837A4FB187A8F140E31DA6D877A4DF3CD5A88344

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF678F23034 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000011.00000002.5435365992.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5435285707.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5435927348.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436076245.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436178070.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436260298.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436342252.00007FF678FA5000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436342252.00007FF678FAA000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436342252.00007FF678FAF000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436602921.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000011.00000002.5436713110.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_17_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction ID: 439c6ad7ad2c74e4a833b8c3f881a943a98c8a34eed6760094fbba1b9a72361c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0113636B24B458AEB00CF71E8452A837A4FB187A8F140E31DA6D877A4DF3CD5A88344

                                                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                                                        Function 00007FF678F23034 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                                                        • Source File: 00000013.00000002.5408504533.00007FF678DD1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF678DD0000, based on PE: true
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5408424982.00007FF678DD0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409139953.00007FF678F5C000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409279253.00007FF678F97000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409352514.00007FF678F98000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409421274.00007FF678F99000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409495247.00007FF678FA5000.00000008.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409604434.00007FF678FA6000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5409604434.00007FF678FAA000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5410009801.00007FF678FB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        • Associated: 00000013.00000002.5410111259.00007FF678FC2000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                        • Snapshot File: hcaresult_19_2_7ff678dd0000_shift.jbxd
                                                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                                                        • API String ID: 2933794660-0
                                                                                                                                                                                                                                                        • Opcode ID: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction ID: 439c6ad7ad2c74e4a833b8c3f881a943a98c8a34eed6760094fbba1b9a72361c
                                                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f47519f0ee46d43b7620131d7c717b9add4f228503d40868306892e2927acf4
                                                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0113636B24B458AEB00CF71E8452A837A4FB187A8F140E31DA6D877A4DF3CD5A88344