Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 19:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/compy12312314/synapse-remasterd
Resource
win10v2004-20240508-en
General
-
Target
https://github.com/compy12312314/synapse-remasterd
Malware Config
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
YellowSkull 2.0.execmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation YellowSkull 2.0.exe Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 3 IoCs
Processes:
YellowSkull 2.0.exebg.exeYSkullLock.exepid process 1324 YellowSkull 2.0.exe 4960 bg.exe 404 YSkullLock.exe -
Processes:
resource yara_rule C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\YellowSkull 2.0.exe upx behavioral1/memory/1324-328-0x0000000000400000-0x0000000000DD9000-memory.dmp upx behavioral1/memory/1324-373-0x0000000000400000-0x0000000000DD9000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YellowSkull2 Special Program = "C:\\YSkullMBRSetup.exe" reg.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\Desktop\Wallpaper = "c:\\yellowskull.bmp" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4900 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133609675961485294" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 3 IoCs
Processes:
chrome.execmd.exeSearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings chrome.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings\MuiCache SearchApp.exe -
Modifies registry key 1 TTPs 7 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 3108 reg.exe 3408 reg.exe 5000 reg.exe 2744 reg.exe 2752 reg.exe 3332 reg.exe 1232 reg.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
chrome.exechrome.exepid process 1804 chrome.exe 1804 chrome.exe 3508 chrome.exe 3508 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
chrome.exepid process 1804 chrome.exe 1804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
Processes:
chrome.exe7zG.exepid process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 5000 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
chrome.exepid process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
YSkullLock.exepid process 404 YSkullLock.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1804 wrote to memory of 1728 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 1728 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 64 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3100 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3100 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe PID 1804 wrote to memory of 3396 1804 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/compy12312314/synapse-remasterd1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffb343aab58,0x7ffb343aab68,0x7ffb343aab782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2036 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=212 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4560 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1552 --field-trial-handle=1932,i,6471143202513487904,7334662796309868619,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\" -ad -an -ai#7zMap4205:180:7zEvent302571⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\readme.txt1⤵
-
C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\YellowSkull 2.0.exe"C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\YellowSkull 2.0.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2428.tmp\YellowSkull2.bat" "2⤵
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\yellowskull.bmp /f3⤵
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v HideFastUserSwitching /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableChangePassword /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableLockWorkstation /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoLogoff /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\bg.exebg.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\YSkullLock.exeYSkullLock.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "YellowSkull2 Special Program" /t REG_SZ /F /D "C:\YSkullMBRSetup.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2428.tmp\k.vbs"3⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x460 0x4b01⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\31e24f78-d9ac-4f34-a696-8646d9393819.tmpFilesize
98KB
MD5a1e6665f8831d3867415e5d0f8ebbc9c
SHA113245bd0419ff2d0007ab6ea8b3b4402ceb03621
SHA256e7d9dd08c6c3d557b9a94060dfc7aa51c514557102c5ced57c1baaf6b1f513d3
SHA512a36ff2a06a5af7d00241a37bbc4d40a7dfc6b0685b80676932bbadeae59d77262355faf9dc154474732f6f153b5effdad1db9043c217273458282ab0cbab11ad
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD55b6ed215ef6ed26974656d3240316d80
SHA15606f46799a2a2cd88b575cae93b73fbf7a78825
SHA2564c623b4ab26ca0b77d8716846fea6213deb1b110df5c91c417ad6e922b377eb2
SHA512a2ba55531684af656c32621dc08872c99ad73c98f7d58de6894cf03c3c3ff66354ffa8c9c9b911b9e86e0c7b79559a6c806cefb351b034f96e9e45e4f2996e35
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5c393f59d8d2aa4767e68677ca1f3e93d
SHA19c05649c240fa9958e974d89e577fbcdc7b28f17
SHA256ba24aa866da70ee3e37e3a27f5b26f3843cf896705c2b57270724e1c9f809bf8
SHA5125c44af24c5308c3539eeb6f78450e8b54e79a9e3a3f4b1524c24dc5e78759157937c84ac7cec2074c07401a805b58c9920415b91f44c06a6607a483249fe400e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD54ac4f4ee7bd06182a9a1eee4ece211f0
SHA1aaa8cc830dcdba44d1bb46cecbb209ab98ae81b2
SHA2562a5e6d1b38055d299db49fc6deeb6ef13a658bcb0487c3d174a1709a7589c1ac
SHA512c103d6efea5cd21522899cf687e31d1319d98a095740dbcdd9cb9a261194e451d0a7cf407470d39839224af3d8378832fb4dee9991524e3dbecd85c261bd4ec4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD515415adaff9e13fa85d20e74a7c92efd
SHA1166edf684a4cc4f479047bd080e233108eae512a
SHA25609c219e0e0472a467792df4ecf873266ecfbb8dc9a18cde5c070e2f1de300660
SHA51221dc73b111f414b17e9227b4fd31c79b8269cc1f59b2062346df9be75624f57e8cc0a83a5e625e192ab129c492ae5eb2092b984f0ac4b923d5cf28f24833ecae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5471b853354b2857d3b3773a66817e6cf
SHA188182a1abd0f9f12855857e9a33d9cd083610bc5
SHA2569c50b6d3efd065689dc67e5e751d23949d4b8bc929f4070f1a01d1b8d6319832
SHA512cb53f030ae9593f18835985a5e5c75b93cba68d1cd06677c87dc3add687085180a7b98be78f4fbab185de45758fcd220dbedb63763f612b876dad89e00f8bb24
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5b64eb35fce8926ed97db32cd9e6299f4
SHA15862e517f22746900afdc698d9f0111a1d4a5dcd
SHA256194a51224e46c488ce95c9a54b873642bb0928abd35c2014b4c16cf43713ae09
SHA512c5cac60ed5530788cf7ef45ad5acc34073ef217ee28532215883ec557eb8a03c2dcac2eb65c16feb5ffff104128d4e3b05878b45c844b4f356a3685b4dc94f7b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD519f755fc875b8c082bbf34fcae39df94
SHA1660d24174de9bf3f8a56959885470fcd00ee7f1d
SHA25632a0e1bc8f0629b008b53744b20037aac1fc984598261b04c583a1ba674bbfca
SHA51216cb0c125741978939dd7c4e35401d9db9843b07f4c0db1513bfca4f5deb5bf133073a78c0cabfe644187c7fe6f94aefbef3383aa546e4a658e3d435ada138d9
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5e319494ebc2c9c646dbdb6b738987aa0
SHA107dd987f376deaffb1a629676f1438b4678c4a29
SHA256aff64f87ce0ccfa9eec1d9a66c5c3f4f20daa754d153eb127aef4d95195db756
SHA512ff50d8867fd0bd016bd7fb1e2d1ade23c308d256303f1039244e5c4272f1ad2a4ff5df4c77fa42369ee847f950c378c9bcb791cd7b39487b00c7a9bdffe07912
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5eddd3a49f9941c34e6c3efeb1329ab1d
SHA1b7f2aaa29b4a45192780802ab193d36a517bbec6
SHA256a36a3b5c1f0af273e5ac4f28ed2292366c078dd82f25c67d16ad708a4a6e33e4
SHA512a5d0183e9ae37b8f9ee40c5747fd65f58cc74aabe7cdbd86f27d456f5cc14efdac54b18256f90872559704916b6d122314c789b147b75db8273c1eaf45f13d70
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD56924c2ca88333597f5fb726cccdd2df0
SHA143457dfea3a4bb3d3dfd48d251d0da77315a3c64
SHA2561697e7a86b5bc8cbd614bcde6a42b5c97af72a7f1bcdd9c611b451fd3b8e8630
SHA5121cb5a864f81a215e9d8c4d6b42d041f48046fc2ac2778874f290ae727a9daa9f7899c7f4bd9096b57c8d0f8b49f14c3d1678c5d0b58532e9c28cccb66cb5100e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5c66fd77e6d0d21c499e1985e354386a6
SHA1d382f2170736a68f4c95b267db368080e68b6d73
SHA256cdc770c5a78bb666a91a801baf1bd1d3e5f84ba804d0cd935cfbfa30cce8ba69
SHA512ffacc10890b85e7fb958f52c26bc756a3478d3011d66bdb5d3f23c7bfcd0109c7266db18495ea9edb90d404b77cf588125f91e5cba9f119eb1badf58f78b5613
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5ba8cbc188325177ec0eeddf3dab940de
SHA1fa6d7e65758264ff7eaa11a8d5ba2fecb993ad4b
SHA256dabbf86fb151a23880054f48d7ddc269d1a90b68792d85a364df12a657a948c7
SHA5121b18a0fe005e7f13b88d808b667f284f8782b822bb149ca4b76a7d147dee2ce07089c184150a07c9c35eb4466cb0a13d0ed2c55c478286a7c26804f6a4518bb0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5e90b2e03ba7a80a8d050bcdfec9a20c8
SHA1b9177cceb500fa366892a8738fd2c5c322f84f6e
SHA256de9f7ac43776a76abf5267b8db663fbb49d95b6f188d4c249a67e51482830241
SHA512664cd331f8492f7f5ff165c8142c5f92b4f241b04dee44b421c71bff17c2c364087133547aa2dd5769689d9ec93a81b251a7348acb50389f937aebbe7d9f11dc
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
129KB
MD560a507882e7870ba91d8a1f173cfeff0
SHA1410704cffcaa7b64e54ba15c55a1423f705c7c5f
SHA256b25f1b76415eafdd541235eb6ec0b17491724c0072a83e606923f424ff076a15
SHA5121a528b4615dec8b6c47a5ec5c9b88fb4c0c6cd0bfad524c3bd0179fc0023db13bc6942dda995e3be06e8451cef3a4aad56a402ecb5b81ce09123ceee6104ff44
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe586ef1.TMPFilesize
88KB
MD57e03946ae9578d34d8cccbc586eb4c4b
SHA1777ad1414a22848131b586dc9982ba0bef0348c2
SHA25681f450729f2e1d1712a54d43233b5720c4e0aedc473032239a42117bb15aa78a
SHA512e03fab80e3f7d3efa99b5665e2e6abf4a78233ce58a1a1596f63cb3b4e3b105789cdb61c25cff6f813785e6a5b2177beafa1b0ab2f36eddb87a76ff76f0a3628
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133609689393809591.txtFilesize
75KB
MD57e7173177299fa6f69248f0d67e6e370
SHA1a24f46d1cc8355b6fd2f45136dddb656c925ee5d
SHA256e8ca2a8ef10de00a3843dbcb5f73e5a8c4b96b7ddfc36882297d2c92457757a5
SHA5122d5db066ddaae038211b7368c4ca1aab455fa018ac256aee7a405975c81bf02143c75870e41b61c309aaaa065e576f77b0c772fbef01d591e5529109fca64e67
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\YSkullLock.exeFilesize
2.9MB
MD52191c3a14b53531e82726b17dd331cef
SHA19fdcc1ef73bbd08ac8f4cb3bdaf4c4ed26a99737
SHA2563b2abd3773e4678100f197f53a886ec833fd2e26aa9a94d780a2d22befdf7d44
SHA51293dc75ae619bcac6566c6e773c3628c2ef1326d988e592e59a1c8f9be304014a970caf40bf255a52b26fb37ca1d2625c8bf95b5dc749f378a0450a74aa3421f9
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\YSkullMBRSetup.exeFilesize
1.3MB
MD5220303eb72ebde4605116640fb719b26
SHA12021794facb35a7a23796e74835d8cf93882ddaf
SHA256f081c913488c3f22b62f906dac2a82a38d085ebe1d28701f0059dfdfbf1ccf42
SHA512dc811be33365049b32c3a47de9b4f4e4f77be0a9dfd14bfcfce92a6f575cf9bbd4aa56fcc92a3d8bf7bd21354f6530f3cc50a1f185a5953861d3a73a3f1738fc
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\YellowSkull.bmpFilesize
2.9MB
MD511bcda64d254ad8dc591b41f8fceb04d
SHA166d9dea8a7c3d0bb6e9924a4c86f5eef98317752
SHA25684c5dad2d4cec5b636c1fae6f1e1482ada9f62363dcf269b4a86f6070d5b50fc
SHA512b26287ed0de799b95a4bb1f18eb92e3a24dc8250eb09c669112d4b60e7e362012c564d0959ddfe128bc00a63601d9132160cc93276cb72ebc0e0ab2fc2d837b2
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\YellowSkull2.batFilesize
3KB
MD54671d5895d88bc19645cab0fc7ca398a
SHA1d6b1ccef99793b0dcd09156a6460027271cde082
SHA256dd8aa9f7955674a7a1b5b222d7c1809c583c705dae8bf476cdd42efcc0afabb5
SHA512ea21a82ccbb1647bdd45890dadb1740a8dbb7d4cd7481a252545a6db2ce7fda1ce7c808b102bbd4dbd8764a6f824d6529044002f234bb5c255504f6b85ab926b
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\bg.exeFilesize
102KB
MD512cf508e9058e3e67cf8a736557c2749
SHA18448240c260ccef2d23854e749387b65e4b6668e
SHA256b3670ec42931e2dea3e03053eda32240d8b6db15bf89d0c74e23e99ecb0aaf49
SHA5127a837b5a89f29974b1e305e2082d5f7aee46bee3cef7e8a8b47a877d5bd6280c359318d6002c2c283aed13054a8ee590778e99e423a25f84f3037b0249c6403a
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\bg.wavFilesize
2.6MB
MD5832b350b50a07906c630a2b8819fd209
SHA1362d4d61df27a40f975e26b3d8ace1e8fac10f94
SHA25694e1cecf8ed740ea45c87927de31005c3b2f9db261aae04fe56a81e337d1e8da
SHA512cf267295d0248029e4a92d1052df1e24c93d3be79adb1efa9723c64e9c7bb52108a3bc194e772ff0e6dcb5b2208e9d7787a81a86e74ee11892571760e40abcbf
-
C:\Users\Admin\AppData\Local\Temp\2428.tmp\k.vbsFilesize
140B
MD5126595a4087b9e1b9bac69aab147c97f
SHA1ef079808ab8f7b762c413c5fa5844f4285f2848c
SHA2564c59cedcafe3f5a1025960b344107f7e18c98ca569d2e6c8aa3d685b20754089
SHA51241cc1badee06c16a0c65cbf7f38a420ca3c8e0ea459afd208b9b01cbeeef6724b8f2c04ecb41bec9d045492f9be0361612204db77eae7e1aeece8fe3761a7eb4
-
C:\Users\Admin\Downloads\YellowSkullVirus-main.zip.crdownloadFilesize
11.9MB
MD56a57ef3c51bebf8a4ecfa427146ac6a3
SHA144823bfbbddef0895b9553c9738de0f9f81c1a90
SHA25654b92b1e602895a3c7f1b892e45d5120b21264f80ceec0447910531e4b84faae
SHA512fe333ae5025a75ae8f2828a564dff1a946f02cb8009868bd8907612293af510692a7c9ab584022d05cd9eba5a9a48ba2c95fa8d3deae755340a26369ff7efee1
-
C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\YellowSkull 2.0.exeFilesize
2.5MB
MD5660e26001a8891e78135a09d3ec2623f
SHA1bd95c1955be08eaecefa7b3dd1cbdac7387b6d06
SHA2561811c7b5ddcc6637a782bf32db70b60bd0bf3ec2b3498716591f718cda25fd14
SHA512590df723aaa52806f664adec89bf6e8e570a9c88b4858131fb59f23e31ab3302189393bceb58fe1aa71475065aefab2d093d5f8ad6296693d4124e5a10a34e92
-
C:\Users\Admin\Downloads\YellowSkullVirus-main\YellowSkullVirus-main\YellowSkull 2.0\readme.txtFilesize
394B
MD5a2a8f6716fe5889f704616038368de82
SHA162491e8b079e97a371904c803fe0f11cbb0d8c96
SHA2563c26f7e09e30073ae5609073a7b711089f03a0731bc6616b8366496da67fdf88
SHA512037c57940eefc2a756878b9fc81f9d90f76696d9c515ffa11e8f6d334c18481f9d64d0a3d940f5f35b4580d75e83eb7999091879ae225d08d393d1cca0e89369
-
\??\pipe\crashpad_1804_ZJORMQGYLGKSUNURMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1324-328-0x0000000000400000-0x0000000000DD9000-memory.dmpFilesize
9.8MB
-
memory/1324-373-0x0000000000400000-0x0000000000DD9000-memory.dmpFilesize
9.8MB
-
memory/4960-393-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB