Overview
overview
10Static
static
7SpySheriff.zip
windows7-x64
1SpySheriff.zip
windows10-2004-x64
1IESecurity.dll
windows7-x64
6IESecurity.dll
windows10-2004-x64
6ProcMon.dll
windows7-x64
1ProcMon.dll
windows10-2004-x64
1ReadME.txt
windows7-x64
1ReadME.txt
windows10-2004-x64
1SpySheriff.dvm
windows7-x64
3SpySheriff.dvm
windows10-2004-x64
3SpySheriff.exe
windows7-x64
7SpySheriff.exe
windows10-2004-x64
8Uninstall.exe
windows7-x64
1Uninstall.exe
windows10-2004-x64
1base.avd
windows7-x64
3base.avd
windows10-2004-x64
3base001.avd
windows7-x64
3base001.avd
windows10-2004-x64
3base002.avd
windows7-x64
3base002.avd
windows10-2004-x64
3found.wav
windows7-x64
1found.wav
windows10-2004-x64
6heur000.dll
windows7-x64
1heur000.dll
windows10-2004-x64
1heur001.dll
windows7-x64
1heur001.dll
windows10-2004-x64
1heur002.dll
windows7-x64
4heur002.dll
windows10-2004-x64
4heur003.dll
windows7-x64
10heur003.dll
windows10-2004-x64
10notfound.wav
windows7-x64
1notfound.wav
windows10-2004-x64
6Analysis
-
max time kernel
33s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 14:29
Behavioral task
behavioral1
Sample
SpySheriff.zip
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SpySheriff.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
IESecurity.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
IESecurity.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
ProcMon.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
ProcMon.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ReadME.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
ReadME.txt
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
SpySheriff.dvm
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
SpySheriff.dvm
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
SpySheriff.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
SpySheriff.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
Uninstall.exe
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
Uninstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
base.avd
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
base.avd
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
base001.avd
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
base001.avd
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
base002.avd
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
base002.avd
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
found.wav
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
found.wav
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
heur000.dll
Resource
win7-20240215-en
Behavioral task
behavioral24
Sample
heur000.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
heur001.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
heur001.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
heur002.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
heur002.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
heur003.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
heur003.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
notfound.wav
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
notfound.wav
Resource
win10v2004-20240412-en
General
-
Target
SpySheriff.exe
-
Size
403KB
-
MD5
c899f93e8b753fedd068ef3fe2edb0fd
-
SHA1
144b1f18d0e307d14937c21ca1d7cbfc91828a10
-
SHA256
5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47
-
SHA512
1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b
-
SSDEEP
12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SpySheriff.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation SpySheriff.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SpySheriff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SpySheriff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpySheriff = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpySheriff.exe" SpySheriff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpySheriff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 21 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz SpySheriff.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Component Information SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data SpySheriff.exe -
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\SOFTWARE\Microsoft\Internet Explorer\Main SpySheriff.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\SOFTWARE\Microsoft\Internet Explorer\Search SpySheriff.exe -
Modifies registry class 5 IoCs
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00C6D95F-329C-409a-81D7-C46C66EA7F33}\InprocServer32 SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SpySheriff.exe -
Suspicious use of FindShellTrayWindow 32 IoCs
Processes:
SpySheriff.exepid process 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
SpySheriff.exepid process 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe 2220 SpySheriff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73c9758,0x7fef73c9768,0x7fef73c97782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2112 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2144 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1488 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1492 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3648 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4348 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4528 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2616 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=1244,i,16376204480947013881,4105192604695468896,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
363B
MD522c2314b856c3ffc176cf806af7da800
SHA1f2fb6d95cfed217e4572e6810cf1aa81bf5c5b49
SHA2567ca8bde612525c08d2b91ec910c00c1796cb415ba65ffe670e395be5649994db
SHA51292707d51e5eccbf334648177f62de02a0edda5d3a4e463092d6120e79fd1b53c731b5c8c1ffb54ac7ba2e47ffdd73b3e75be04fbf40e67e5140c68102011b1b6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5dead3c7bfd2ac0fa08b95457f43f51e1
SHA17623f6fed88e4f8b02182eaf1eb9cdaa08f3e43e
SHA2568cf0ff0caf88f3541d8e90c948dea3aeef007cdf5f519e25625c6b5fde7c7292
SHA512431f074f5b8023e11c14d0913b73d6e7a9483961586bfe7dad45ec69c144b0f28d0d5ec6313ba292bb894b8ab29c84b11a564f1bcc9f2c4e30c31221016096b9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmpFilesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpySheriff\SpySheriff.lnkFilesize
1KB
MD59d5ff66e01a888f357746546b7c09b25
SHA1c91344f6fb9b10bfec06bae1248cf09da369cbea
SHA25643ccae539f38ccff3d78d1c3f2facc81684b9ad37159424586210c443918b973
SHA5125d972bb40ef65ffbea4cfa9316024686294f51eaa5fb5f8c8e40829c24a3ea37242eee1ce1018aa32ce4912c9eb3c69891c8fb7dcfb514913a817fa0011016ff
-
\??\pipe\crashpad_576_XZPYJUYAHHSNPAVQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2220-36-0x000000001F920000-0x000000001F946000-memory.dmpFilesize
152KB
-
memory/2220-0-0x0000000000280000-0x00000000002AC000-memory.dmpFilesize
176KB
-
memory/2220-16-0x000000001AF20000-0x000000001AF21000-memory.dmpFilesize
4KB
-
memory/2220-15-0x000000001AF80000-0x000000001AF81000-memory.dmpFilesize
4KB
-
memory/2220-14-0x0000000019940000-0x0000000019941000-memory.dmpFilesize
4KB
-
memory/2220-13-0x000000001B030000-0x000000001B031000-memory.dmpFilesize
4KB
-
memory/2220-12-0x000000001AF50000-0x000000001AF51000-memory.dmpFilesize
4KB
-
memory/2220-11-0x000000001AF30000-0x000000001AF31000-memory.dmpFilesize
4KB
-
memory/2220-10-0x000000001B000000-0x000000001B001000-memory.dmpFilesize
4KB
-
memory/2220-9-0x000000001B190000-0x000000001B191000-memory.dmpFilesize
4KB
-
memory/2220-31-0x000000001E570000-0x000000001E571000-memory.dmpFilesize
4KB
-
memory/2220-7-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/2220-6-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2220-5-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/2220-4-0x0000000000360000-0x0000000000361000-memory.dmpFilesize
4KB
-
memory/2220-3-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/2220-2-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2220-1-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2220-19-0x000000001C580000-0x000000001C590000-memory.dmpFilesize
64KB
-
memory/2220-25-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/2220-35-0x000000001E760000-0x000000001E761000-memory.dmpFilesize
4KB
-
memory/2220-34-0x000000001C6E0000-0x000000001C6E1000-memory.dmpFilesize
4KB
-
memory/2220-41-0x000000001FB70000-0x000000001FB71000-memory.dmpFilesize
4KB
-
memory/2220-42-0x0000000021040000-0x0000000021041000-memory.dmpFilesize
4KB
-
memory/2220-40-0x0000000020E90000-0x0000000020EBC000-memory.dmpFilesize
176KB
-
memory/2220-39-0x000000001FB60000-0x000000001FB61000-memory.dmpFilesize
4KB
-
memory/2220-38-0x000000001F950000-0x000000001F951000-memory.dmpFilesize
4KB
-
memory/2220-37-0x000000001F990000-0x000000001F9BC000-memory.dmpFilesize
176KB
-
memory/2220-17-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2220-33-0x000000001E710000-0x000000001E711000-memory.dmpFilesize
4KB
-
memory/2220-92-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-18-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2220-8-0x000000001AFA0000-0x000000001AFA1000-memory.dmpFilesize
4KB
-
memory/2220-30-0x000000001E6E0000-0x000000001E6E1000-memory.dmpFilesize
4KB
-
memory/2220-29-0x000000001E6F0000-0x000000001E6F1000-memory.dmpFilesize
4KB
-
memory/2220-28-0x000000001E700000-0x000000001E701000-memory.dmpFilesize
4KB
-
memory/2220-27-0x000000001C650000-0x000000001C651000-memory.dmpFilesize
4KB
-
memory/2220-26-0x000000001E540000-0x000000001E568000-memory.dmpFilesize
160KB
-
memory/2220-44-0x00000000219E0000-0x00000000219E1000-memory.dmpFilesize
4KB
-
memory/2220-46-0x0000000020D00000-0x0000000020D23000-memory.dmpFilesize
140KB
-
memory/2220-45-0x000000001E5A0000-0x000000001E5CC000-memory.dmpFilesize
176KB
-
memory/2220-47-0x00000000216A0000-0x00000000216C4000-memory.dmpFilesize
144KB
-
memory/2220-48-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-49-0x000000001E540000-0x000000001E568000-memory.dmpFilesize
160KB
-
memory/2220-53-0x0000000000280000-0x00000000002AC000-memory.dmpFilesize
176KB
-
memory/2220-55-0x000000001E780000-0x000000001E781000-memory.dmpFilesize
4KB
-
memory/2220-54-0x000000001E790000-0x000000001E791000-memory.dmpFilesize
4KB
-
memory/2220-56-0x000000001E7B0000-0x000000001E7B1000-memory.dmpFilesize
4KB
-
memory/2220-57-0x000000001E7A0000-0x000000001E7A1000-memory.dmpFilesize
4KB
-
memory/2220-59-0x000000001E7C0000-0x000000001E7C1000-memory.dmpFilesize
4KB
-
memory/2220-58-0x000000001E7D0000-0x000000001E7D1000-memory.dmpFilesize
4KB
-
memory/2220-60-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-63-0x000000001F920000-0x000000001F946000-memory.dmpFilesize
152KB
-
memory/2220-64-0x0000000020D00000-0x0000000020D23000-memory.dmpFilesize
140KB
-
memory/2220-65-0x00000000216A0000-0x00000000216C4000-memory.dmpFilesize
144KB
-
memory/2220-66-0x000000001C580000-0x000000001C590000-memory.dmpFilesize
64KB
-
memory/2220-62-0x000000001E540000-0x000000001E568000-memory.dmpFilesize
160KB
-
memory/2220-72-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-82-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-43-0x0000000021700000-0x000000002172C000-memory.dmpFilesize
176KB
-
memory/2220-87-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-32-0x000000001E6D0000-0x000000001E6D1000-memory.dmpFilesize
4KB
-
memory/2220-97-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/2220-102-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB