Overview
overview
10Static
static
7IESecurity.dll
windows7-x64
6IESecurity.dll
windows10-2004-x64
6ProcMon.dll
windows7-x64
1ProcMon.dll
windows10-2004-x64
1SpySheriff.exe
windows7-x64
8SpySheriff.exe
windows10-2004-x64
7Uninstall.exe
windows7-x64
1Uninstall.exe
windows10-2004-x64
1heur000.dll
windows7-x64
1heur000.dll
windows10-2004-x64
1heur001.dll
windows7-x64
1heur001.dll
windows10-2004-x64
1heur002.dll
windows7-x64
4heur002.dll
windows10-2004-x64
4heur003.dll
windows7-x64
10heur003.dll
windows10-2004-x64
10Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 20:23
Behavioral task
behavioral1
Sample
IESecurity.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
IESecurity.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
ProcMon.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
ProcMon.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
SpySheriff.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
SpySheriff.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
heur000.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
heur000.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
heur001.dll
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
heur001.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
heur002.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
heur002.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
heur003.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
heur003.dll
Resource
win10v2004-20240508-en
General
-
Target
SpySheriff.exe
-
Size
403KB
-
MD5
c899f93e8b753fedd068ef3fe2edb0fd
-
SHA1
144b1f18d0e307d14937c21ca1d7cbfc91828a10
-
SHA256
5c2a85fb56de2e0a1a1d260ef2177e0209477586c8a6740494bbaf40a9785f47
-
SHA512
1aceacb4eba0815322dd3fcd273d8703408362eee3b2d2b5981d2abbe4c2b02852608f46b2e7ce46a50e921871d445c239014b5957c6ba0606bd0334ce7bd41b
-
SSDEEP
12288:eBMDMf+ztV53y2k9I68iXDycz+rYIYsVRSHsDr:eS4S53h68eIZjD
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpySheriff.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation SpySheriff.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SpySheriff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SpySheriff.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpySheriff = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpySheriff.exe" SpySheriff.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpySheriff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SpySheriff.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz SpySheriff.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
Processes:
SpySheriff.exedescription ioc process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter SpySheriff.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier SpySheriff.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information SpySheriff.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 SpySheriff.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information SpySheriff.exe -
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Main SpySheriff.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Internet Explorer\Search SpySheriff.exe -
Modifies registry class 4 IoCs
Processes:
SpySheriff.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ SpySheriff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" SpySheriff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SpySheriff.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
SpySheriff.exepid process 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
SpySheriff.exepid process 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe 4428 SpySheriff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"1⤵
- Checks BIOS information in registry
- Checks computer location settings
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\SpySheriff.lnkFilesize
1KB
MD5e0c391f71563e55b7eeea98b4075b2a1
SHA12ee3df870d7bac1caca14837b79bdfebe49f2ddf
SHA256e6ca305c77528cc1077c4395b94268e815b487a052fc336436423360874626cc
SHA512c54b56adc6aab79fac1b76ceddcb45a8640a36158805fa641053276747918acaf67d8be0ec90dcd72a899b52bc075933d5e6c8d5abb95e64c5ca642c0205e6d6
-
memory/4428-10-0x0000000021AF0000-0x0000000021B14000-memory.dmpFilesize
144KB
-
memory/4428-9-0x0000000021250000-0x0000000021273000-memory.dmpFilesize
140KB
-
memory/4428-8-0x000000001FC70000-0x000000001FC96000-memory.dmpFilesize
152KB
-
memory/4428-7-0x000000001E980000-0x000000001E9A8000-memory.dmpFilesize
160KB
-
memory/4428-6-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4428-11-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4428-21-0x0000000021AF0000-0x0000000021B14000-memory.dmpFilesize
144KB
-
memory/4428-20-0x0000000021250000-0x0000000021273000-memory.dmpFilesize
140KB
-
memory/4428-19-0x000000001FC70000-0x000000001FC96000-memory.dmpFilesize
152KB
-
memory/4428-18-0x000000001E980000-0x000000001E9A8000-memory.dmpFilesize
160KB
-
memory/4428-17-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4428-22-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/4428-32-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB