Back any.run

ANY.RUN sandbox report for a Shift named file (search result summary)

any.run • October 13, 2026

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

036AF5D398ADB182C7BCA2A1B6EE54F5

59CE8F46C6E5BCA415910EF5B0F00F24608C81A6

16290D7097C8FACBA01211B106C599B80EB8F2B029F9D186F2BAAF1D0B3C380B

3:8VDNyGKSK2CR6d2JFTdn:8R4GKSK/R6d2Ddn

Internet Explorer 11.3636.19041.0

Adobe Acrobat (64-bit) (23.001.20093)

Adobe Flash Player 32 NPAPI (32.0.0.465)

Adobe Flash Player 32 PPAPI (32.0.0.465)

FileZilla 3.65.0 (3.65.0)

Google Chrome (133.0.6943.127)

Google Update Helper (1.3.36.51)

Java 8 Update 271 (64-bit) (8.0.2710.9)

Java Auto Updater (2.8.271.9)

Microsoft Edge (133.0.3065.92)

Microsoft Office Professional 2019 - de-de (16.0.16026.20146)

Microsoft Office Professional 2019 - en-us (16.0.16026.20146)

Microsoft Office Professional 2019 - es-es (16.0.16026.20146)

Microsoft Office Professional 2019 - it-it (16.0.16026.20146)

Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)

Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)

Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)

Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)

Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)

Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)

Microsoft OneNote - en-us (16.0.16026.20146)

Microsoft Update Health Tools (3.74.0.0)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)

Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)

Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)

Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)

Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)

Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)

Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)

Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)

Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)

Mozilla Firefox (x64 en-US) (136.0)

Mozilla Maintenance Service (136.0)

Notepad++ (64-bit x64) (7.9.1)

Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)

Office 16 Click-to-Run Licensing Component (16.0.16026.20146)

Office 16 Click-to-Run Localization Component (16.0.15726.20202)

Office 16 Click-to-Run Localization Component (16.0.15928.20198)

PowerShell 7-x64 (7.3.5.0)

Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)

Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)

Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)

Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)

VLC media player (3.0.11)

WinRAR 5.91 (64-bit) (5.91.0)

Windows PC Health Check (3.6.2204.08001)

Client LanguagePack Package

InternetExplorer Optional Package

LanguageFeatures Basic en us Package

LanguageFeatures Handwriting en us Package

LanguageFeatures OCR en us Package

LanguageFeatures Speech en us Package

LanguageFeatures TextToSpeech en us Package

Microsoft OneCore ApplicationModel Sync Desktop FOD Package

Microsoft OneCore DirectX Database FOD Package

NetFx3 OnDemand Package

OpenSSH Client Package

PowerShell ISE FOD Package

Printing PMCPPC FoD Package

Printing WFS FoD Package

StepsRecorder Package

UserExperience Desktop Package

MALICIOUS Actions looks like stealing of personal data shift.exe (PID: 7428) shift.exe (PID: 432) Steals credentials from Web Browsers shift.exe (PID: 7428) Changes the autorun value in the registry shift.exe (PID: 7428)

Actions looks like stealing of personal data shift.exe (PID: 7428) shift.exe (PID: 432)

Actions looks like stealing of personal data

shift.exe (PID: 7428)

Steals credentials from Web Browsers shift.exe (PID: 7428)

Steals credentials from Web Browsers

shift.exe (PID: 7428)

Changes the autorun value in the registry shift.exe (PID: 7428)

Changes the autorun value in the registry

shift.exe (PID: 7428)

SUSPICIOUS Executable content was dropped or overwritten shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) Shift Setup_xm85c2.exe (PID: 7520) Shift Setup_xm85c2.tmp (PID: 5244) shift - pdf_xm85c2.tmp (PID: 2596) Reads the Windows owner or organization settings shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) There is functionality for taking screenshot (YARA) shift - pdf_xm85c2.tmp (PID: 7968) Reads security settings of Internet Explorer shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) Uses TASKKILL.EXE to kill process Shift Setup_xm85c2.tmp (PID: 5244) Deletes scheduled task without confirmation schtasks.exe (PID: 6224) Uses ICACLS.EXE to modify access control lists Shift Setup_xm85c2.tmp (PID: 5244) Application launched itself shift.exe (PID: 7428) shift.exe (PID: 7420) Process drops legitimate windows executable Shift Setup_xm85c2.tmp (PID: 5244) Reads Mozilla Firefox installation path shift.exe (PID: 7428) Executes application which crashes Shift Setup_xm85c2.tmp (PID: 5244) The process checks if it is being run in the virtual environment shift.exe (PID: 7428)

Executable content was dropped or overwritten shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) Shift Setup_xm85c2.exe (PID: 7520) Shift Setup_xm85c2.tmp (PID: 5244) shift - pdf_xm85c2.tmp (PID: 2596)

Executable content was dropped or overwritten

shift - pdf_xm85c2.exe (PID: 7964)

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.exe (PID: 6796)

Shift Setup_xm85c2.exe (PID: 7520)

Shift Setup_xm85c2.tmp (PID: 5244)

shift - pdf_xm85c2.tmp (PID: 2596)

Reads the Windows owner or organization settings shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244)

Reads the Windows owner or organization settings

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.tmp (PID: 2596)

Shift Setup_xm85c2.tmp (PID: 5244)

There is functionality for taking screenshot (YARA) shift - pdf_xm85c2.tmp (PID: 7968)

There is functionality for taking screenshot (YARA)

shift - pdf_xm85c2.tmp (PID: 7968)

Reads security settings of Internet Explorer shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428)

Reads security settings of Internet Explorer

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.tmp (PID: 2596)

Shift Setup_xm85c2.tmp (PID: 5244)

shift.exe (PID: 7428)

Uses TASKKILL.EXE to kill process Shift Setup_xm85c2.tmp (PID: 5244)

Uses TASKKILL.EXE to kill process

Shift Setup_xm85c2.tmp (PID: 5244)

Deletes scheduled task without confirmation schtasks.exe (PID: 6224)

Deletes scheduled task without confirmation

schtasks.exe (PID: 6224)

Uses ICACLS.EXE to modify access control lists Shift Setup_xm85c2.tmp (PID: 5244)

Uses ICACLS.EXE to modify access control lists

Shift Setup_xm85c2.tmp (PID: 5244)

Application launched itself shift.exe (PID: 7428) shift.exe (PID: 7420)

Application launched itself

shift.exe (PID: 7428)

shift.exe (PID: 7420)

Process drops legitimate windows executable Shift Setup_xm85c2.tmp (PID: 5244)

Process drops legitimate windows executable

Shift Setup_xm85c2.tmp (PID: 5244)

Reads Mozilla Firefox installation path shift.exe (PID: 7428)

Reads Mozilla Firefox installation path

shift.exe (PID: 7428)

Executes application which crashes Shift Setup_xm85c2.tmp (PID: 5244)

Executes application which crashes

Shift Setup_xm85c2.tmp (PID: 5244)

The process checks if it is being run in the virtual environment shift.exe (PID: 7428)

The process checks if it is being run in the virtual environment

shift.exe (PID: 7428)

INFO Executable content was dropped or overwritten msedge.exe (PID: 3936) msedge.exe (PID: 5460) Application launched itself msedge.exe (PID: 3936) chrome.exe (PID: 7952) Reads Environment values identity_helper.exe (PID: 7632) shift.exe (PID: 7428) Checks supported languages identity_helper.exe (PID: 7632) shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 2596) shift - pdf_xm85c2.exe (PID: 6796) Shift Setup_xm85c2.tmp (PID: 5244) Shift Setup_xm85c2.exe (PID: 7520) shift.exe (PID: 7428) shift.exe (PID: 7420) shift - pdf_xm85c2.tmp (PID: 7968) shift.exe (PID: 5600) shift.exe (PID: 2876) shift.exe (PID: 6140) shift.exe (PID: 1576) shift.exe (PID: 432) shift.exe (PID: 4824) shift.exe (PID: 8088) shift.exe (PID: 5500) shift.exe (PID: 3968) shift.exe (PID: 8468) Reads the computer name identity_helper.exe (PID: 7632) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) shift - pdf_xm85c2.tmp (PID: 7968) shift.exe (PID: 2876) shift.exe (PID: 1576) shift.exe (PID: 432) shift.exe (PID: 8468) shift.exe (PID: 7420) Create files in a temporary directory shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) Shift Setup_xm85c2.exe (PID: 7520) Shift Setup_xm85c2.tmp (PID: 5244) shift - pdf_xm85c2.tmp (PID: 2596) shift.exe (PID: 7428) shift.exe (PID: 432) Reads the machine GUID from the registry shift - pdf_xm85c2.tmp (PID: 7968) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) Reads the software policy settings shift - pdf_xm85c2.tmp (PID: 7968) Shift Setup_xm85c2.tmp (PID: 5244) shift - pdf_xm85c2.tmp (PID: 2596) WerFault.exe (PID: 1844) WerFault.exe (PID: 8816) slui.exe (PID: 8020) Detects InnoSetup installer (YARA) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) shift - pdf_xm85c2.exe (PID: 7964) Compiled with Borland Delphi (YARA) shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) Process checks computer location settings shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) shift.exe (PID: 3968) shift.exe (PID: 8088) shift.exe (PID: 4824) shift.exe (PID: 5500) The sample compiled with english language support Shift Setup_xm85c2.tmp (PID: 5244) Creates a software uninstall entry Shift Setup_xm85c2.tmp (PID: 5244) Creates files or folders in the user directory Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) shift.exe (PID: 7420) shift.exe (PID: 2876) WerFault.exe (PID: 1844) WerFault.exe (PID: 8816) Checks proxy server information shift - pdf_xm85c2.tmp (PID: 7968) shift.exe (PID: 7428) WerFault.exe (PID: 1844) WerFault.exe (PID: 8816) slui.exe (PID: 8020) Launching a file from a Registry key shift.exe (PID: 7428) Reads CPU info shift.exe (PID: 7428)

Executable content was dropped or overwritten msedge.exe (PID: 3936) msedge.exe (PID: 5460)

Executable content was dropped or overwritten

msedge.exe (PID: 3936)

msedge.exe (PID: 5460)

Application launched itself msedge.exe (PID: 3936) chrome.exe (PID: 7952)

Application launched itself

msedge.exe (PID: 3936)

chrome.exe (PID: 7952)

Reads Environment values identity_helper.exe (PID: 7632) shift.exe (PID: 7428)

Reads Environment values

identity_helper.exe (PID: 7632)

shift.exe (PID: 7428)

Checks supported languages identity_helper.exe (PID: 7632) shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 2596) shift - pdf_xm85c2.exe (PID: 6796) Shift Setup_xm85c2.tmp (PID: 5244) Shift Setup_xm85c2.exe (PID: 7520) shift.exe (PID: 7428) shift.exe (PID: 7420) shift - pdf_xm85c2.tmp (PID: 7968) shift.exe (PID: 5600) shift.exe (PID: 2876) shift.exe (PID: 6140) shift.exe (PID: 1576) shift.exe (PID: 432) shift.exe (PID: 4824) shift.exe (PID: 8088) shift.exe (PID: 5500) shift.exe (PID: 3968) shift.exe (PID: 8468)

Checks supported languages

identity_helper.exe (PID: 7632)

shift - pdf_xm85c2.exe (PID: 7964)

shift - pdf_xm85c2.tmp (PID: 2596)

shift - pdf_xm85c2.exe (PID: 6796)

Shift Setup_xm85c2.tmp (PID: 5244)

Shift Setup_xm85c2.exe (PID: 7520)

shift.exe (PID: 7428)

shift.exe (PID: 7420)

shift - pdf_xm85c2.tmp (PID: 7968)

shift.exe (PID: 5600)

shift.exe (PID: 2876)

shift.exe (PID: 6140)

shift.exe (PID: 1576)

shift.exe (PID: 4824)

shift.exe (PID: 8088)

shift.exe (PID: 5500)

shift.exe (PID: 3968)

shift.exe (PID: 8468)

Reads the computer name identity_helper.exe (PID: 7632) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) shift - pdf_xm85c2.tmp (PID: 7968) shift.exe (PID: 2876) shift.exe (PID: 1576) shift.exe (PID: 432) shift.exe (PID: 8468) shift.exe (PID: 7420)

Reads the computer name

identity_helper.exe (PID: 7632)

shift - pdf_xm85c2.tmp (PID: 2596)

Shift Setup_xm85c2.tmp (PID: 5244)

shift.exe (PID: 7428)

shift - pdf_xm85c2.tmp (PID: 7968)

shift.exe (PID: 2876)

shift.exe (PID: 1576)

shift.exe (PID: 8468)

shift.exe (PID: 7420)

Create files in a temporary directory shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) Shift Setup_xm85c2.exe (PID: 7520) Shift Setup_xm85c2.tmp (PID: 5244) shift - pdf_xm85c2.tmp (PID: 2596) shift.exe (PID: 7428) shift.exe (PID: 432)

Create files in a temporary directory

shift - pdf_xm85c2.exe (PID: 7964)

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.exe (PID: 6796)

Shift Setup_xm85c2.exe (PID: 7520)

Shift Setup_xm85c2.tmp (PID: 5244)

shift - pdf_xm85c2.tmp (PID: 2596)

shift.exe (PID: 7428)

Reads the machine GUID from the registry shift - pdf_xm85c2.tmp (PID: 7968) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428)

Reads the machine GUID from the registry

shift - pdf_xm85c2.tmp (PID: 7968)

Shift Setup_xm85c2.tmp (PID: 5244)

shift.exe (PID: 7428)

Reads the software policy settings shift - pdf_xm85c2.tmp (PID: 7968) Shift Setup_xm85c2.tmp (PID: 5244) shift - pdf_xm85c2.tmp (PID: 2596) WerFault.exe (PID: 1844) WerFault.exe (PID: 8816) slui.exe (PID: 8020)

Reads the software policy settings

shift - pdf_xm85c2.tmp (PID: 7968)

Shift Setup_xm85c2.tmp (PID: 5244)

shift - pdf_xm85c2.tmp (PID: 2596)

WerFault.exe (PID: 1844)

WerFault.exe (PID: 8816)

Detects InnoSetup installer (YARA) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796) shift - pdf_xm85c2.exe (PID: 7964)

Detects InnoSetup installer (YARA)

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.exe (PID: 6796)

shift - pdf_xm85c2.exe (PID: 7964)

Compiled with Borland Delphi (YARA) shift - pdf_xm85c2.exe (PID: 7964) shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.exe (PID: 6796)

Compiled with Borland Delphi (YARA)

shift - pdf_xm85c2.exe (PID: 7964)

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.exe (PID: 6796)

Process checks computer location settings shift - pdf_xm85c2.tmp (PID: 7968) shift - pdf_xm85c2.tmp (PID: 2596) Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) shift.exe (PID: 3968) shift.exe (PID: 8088) shift.exe (PID: 4824) shift.exe (PID: 5500)

Process checks computer location settings

shift - pdf_xm85c2.tmp (PID: 7968)

shift - pdf_xm85c2.tmp (PID: 2596)

Shift Setup_xm85c2.tmp (PID: 5244)

shift.exe (PID: 7428)

shift.exe (PID: 3968)

shift.exe (PID: 8088)

shift.exe (PID: 4824)

shift.exe (PID: 5500)

The sample compiled with english language support Shift Setup_xm85c2.tmp (PID: 5244)

The sample compiled with english language support

Shift Setup_xm85c2.tmp (PID: 5244)

Creates a software uninstall entry Shift Setup_xm85c2.tmp (PID: 5244)

Creates a software uninstall entry

Shift Setup_xm85c2.tmp (PID: 5244)

Creates files or folders in the user directory Shift Setup_xm85c2.tmp (PID: 5244) shift.exe (PID: 7428) shift.exe (PID: 7420) shift.exe (PID: 2876) WerFault.exe (PID: 1844) WerFault.exe (PID: 8816)

Creates files or folders in the user directory

Shift Setup_xm85c2.tmp (PID: 5244)

shift.exe (PID: 7428)

shift.exe (PID: 7420)

shift.exe (PID: 2876)

WerFault.exe (PID: 1844)

WerFault.exe (PID: 8816)

Checks proxy server information shift - pdf_xm85c2.tmp (PID: 7968) shift.exe (PID: 7428) WerFault.exe (PID: 1844) WerFault.exe (PID: 8816) slui.exe (PID: 8020)

Checks proxy server information

shift - pdf_xm85c2.tmp (PID: 7968)

shift.exe (PID: 7428)

WerFault.exe (PID: 1844)

WerFault.exe (PID: 8816)

Launching a file from a Registry key shift.exe (PID: 7428)

Launching a file from a Registry key

shift.exe (PID: 7428)

Reads CPU info shift.exe (PID: 7428)

shift.exe (PID: 7428)

Program did not start

Low-level access to the HDD

Process was added to the startup

Debug information is available

Probably Tor was used

Behavior similar to spam

Task has injected processes

Executable file was dropped

Network attacks were detected

Integrity level elevation

Connects to the network

Process starts the services

Task contains several apps running

Application downloaded the executable file

Actions similar to stealing personal data

Task has apps ended with an error

File is detected by antivirus software

Inspected object has suspicious PE structure

Behavior similar to exploiting the vulnerability

Task contains an error or was rebooted

The process has the malware config

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Shift Browser Malware: Surge in Detections Linked to Malvertising On October 13, 2026, reports emerged about a program called Shift Browser, flagged as a potentially unwanted program (PUP) by Malwarebytes since October 2024. The Heimdal Security MXDR team detected a surge in Shift Browser detections on September 2, 2026, affecting over 50 client environments in a single day. The program is distributed via malvertising, often misleading users into installation. Users report that Shift Browser auto-starts with Windows, hijacks default browser settings, and resists standard uninstallation methods. While Shift Technologies claims it is not malware, the program's behavior and distribution methods raise significant concerns. The current status indicates ongoing user reports of unwanted behavior, but no confirmed malicious payloads have been identified. The situation remains under observation as security vendors continue to analyze the program's impact. 1 sources 40

Extracted Entities

ANY.RUN sandbox report for a Shift named file (search result summary)

The full story

Extracted Entities

Attack Types (2)

MD5 Hashes (1)

MITRE ATT&CK (6)

Platforms (1)

SHA1 Hashes (1)

SHA256 Hashes (1)

Tools (1)