Analysis Overview
SHA256
972d58a325c303624e7ee5e10263c6ec3676ccc05755e2cd73b0b8ff7eef9f0e
Threat Level: Shows suspicious behavior
The file version.dll was found to be: Shows suspicious behavior.
Malicious Activity Summary
Writes to the Master Boot Record (MBR)
Legitimate hosting services abused for malware hosting/C2
Program crash
Browser Information Discovery
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Enterprise Matrix V16
Analysis: static1
Detonation Overview
Reported
2025-06-04 17:18
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-06-04 17:18
Reported
2025-06-04 17:21
Platform
win10v2004-20250502-en
Max time kernel
125s
Max time network
136s
Command Line
Signatures
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | raw.githubusercontent.com | N/A | N/A |
| N/A | raw.githubusercontent.com | N/A | N/A |
Writes to the Master Boot Record (MBR)
| Description | Indicator | Process | Target |
| File opened for modification | \??\PhysicalDrive0 | C:\Users\Admin\Downloads\Petya.A\[email protected] | N/A |
Browser Information Discovery
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\Downloads\Petya.A\[email protected] | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133935311564155954" | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3920234085-916416549-2700794571-1000_Classes\Local Settings | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
| N/A | N/A | C:\Program Files\Google\Chrome\Application\chrome.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\Downloads\Petya.A\[email protected] | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 2548 -ip 2548
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 624
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff1bf6dcf8,0x7fff1bf6dd04,0x7fff1bf6dd10
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2176,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2204 /prefetch:3
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2092,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2084 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2440,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=2508 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3188 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3204,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3224 /prefetch:1
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3968,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4496 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4768,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4788 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5380,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5396 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5604,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5616 /prefetch:8
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5764,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5792 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5928,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5952 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5944,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=6096 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6120,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5972 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6000,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=6024 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3156,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4672 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3256,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4664 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4924,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4660 /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3972,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=4548 /prefetch:2
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5908,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=3360 /prefetch:1
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5832,i,10803567447298305928,10265264412098778021,262144 --variations-seed-version=20250501-050124.630000 --mojo-platform-channel-handle=5824 /prefetch:8
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\Downloads\Petya.A\[email protected]
"C:\Users\Admin\Downloads\Petya.A\[email protected]"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.google.com | udp |
| NL | 142.250.27.105:443 | www.google.com | tcp |
| NL | 142.250.27.105:443 | www.google.com | udp |
| US | 8.8.8.8:53 | clients2.google.com | udp |
| NL | 142.250.102.138:443 | clients2.google.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | clients2.googleusercontent.com | udp |
| NL | 142.250.102.132:443 | clients2.googleusercontent.com | tcp |
| NL | 142.250.27.105:443 | www.google.com | udp |
| US | 8.8.8.8:53 | content-autofill.googleapis.com | udp |
| US | 8.8.8.8:53 | dns-tunnel-check.googlezip.net | udp |
| US | 8.8.8.8:53 | tunnel.googlezip.net | udp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 8.8.8.8:53 | ogads-pa.clients6.google.com | udp |
| NL | 142.250.27.105:443 | www.google.com | udp |
| US | 216.239.34.157:443 | tunnel.googlezip.net | tcp |
| US | 8.8.8.8:53 | play.google.com | udp |
| NL | 142.250.102.113:443 | play.google.com | tcp |
| NL | 142.250.102.113:443 | play.google.com | udp |
| US | 8.8.8.8:53 | consent.google.com | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 8.8.8.8:53 | avatars.githubusercontent.com | udp |
| US | 8.8.8.8:53 | github.githubassets.com | udp |
| US | 8.8.8.8:53 | private-user-images.githubusercontent.com | udp |
| US | 185.199.111.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 185.199.111.133:443 | private-user-images.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | user-images.githubusercontent.com | udp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 8.8.8.8:53 | github-cloud.s3.amazonaws.com | udp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 185.199.111.133:443 | user-images.githubusercontent.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| GB | 20.26.156.215:443 | github.com | tcp |
| US | 8.8.8.8:53 | collector.github.com | udp |
| US | 185.199.109.154:443 | github.githubassets.com | tcp |
| US | 140.82.113.22:443 | collector.github.com | tcp |
| US | 8.8.8.8:53 | api.github.com | udp |
| GB | 20.26.156.210:443 | api.github.com | tcp |
| US | 8.8.8.8:53 | beacons.gcp.gvt2.com | udp |
| GB | 142.251.29.94:443 | beacons.gcp.gvt2.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| NL | 142.250.27.94:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.111.133:443 | raw.githubusercontent.com | tcp |
Files
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | ac199b689d214b7102fbfb82e282c8c6 |
| SHA1 | e1ce373e0cd4517acd82bc0de7da137df82675a8 |
| SHA256 | e19bef15d004a7991c8bd479f7c20626ac46c5025b5f0d64a958fb83bb9ab147 |
| SHA512 | b565544865125487fafc4afa894cbaacd9489ab3873984d011ffd5167f013018922fdfcae15dec6efb1eae2c9b73a82ac709427d0c85cf09a0574fd36ac40270 |
\??\pipe\crashpad_2520_QSOICOSQHIQSYWIQ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
| MD5 | d751713988987e9331980363e24189ce |
| SHA1 | 97d170e1550eee4afc0af065b78cda302a97674c |
| SHA256 | 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945 |
| SHA512 | b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af |
C:\Users\Admin\AppData\Local\Temp\scoped_dir2520_1765942567\60f66f7c-c0f2-4518-81f4-141a66923a18.tmp
| MD5 | cc05ed3e66468e692745ba6563c69740 |
| SHA1 | eae9dbd4d36aa91fd43f7d452ac3d252b103759d |
| SHA256 | fb1311fb7142825abacb3c7aedddf948f5c9b258e447c953ce0f7f4b19c6dfff |
| SHA512 | 4b527db02d6ea36b914558a3e44fd3d15772bf2be4ba0a640bf70427af07dcde5ed6967930cc3624a244cfc82290f125eea2754812586216b3d5a37757ce8db4 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
| MD5 | 8859933a105088a0e025230585210364 |
| SHA1 | 53cfa57e2e8652b47cbb6d01a88f436fba410e4f |
| SHA256 | 93baef8680d46142ae7b29adb3f3f564223022a4b2a92c19115ec43017b3212c |
| SHA512 | 461d630e99e73c274f523c0c9697c90bafe24a72bfd0199ebe03f3b3af2ae70f90cf4afa65725e0807a01082e9a50229bd90a10bcf51a448f3ac562983fb128f |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | db0380bbbeb7754efb2d2ebe16661008 |
| SHA1 | 41a0eae37e4728d6e0a1a5b653f6a7d0cdf747a8 |
| SHA256 | 7f36481b2285f0b194a3c4ae0b4b9095a1973215e7b0916c38ca543842857fe7 |
| SHA512 | 73631fbaa938dba1014ce74d4e3d4369ca2bcebc8342c64f4c0b114e56e6b18859161864b1aa6303b64ff212e6b7da4d716ef1c94ca937cd8bd66218920eba01 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 821c5cface8a8ca3aba12cb76a9f35f7 |
| SHA1 | 72109fe6b43306ac80f42bd9d43a6fbeda553ff3 |
| SHA256 | 445b9174bde28998c85ddf5a3caa7494afd2d01d85c8ae57c96aaabdfd9d29d0 |
| SHA512 | 82beea461ef25ce823b9998c2704b912e8d38bd19e86e586c96d448884f7a5aafb8a85d1e679cf90a80ee3086b0a014e4023f4ea4b754f281e03bda892ab9f29 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | a14197b9a3e0e6be1f3d861bba125bde |
| SHA1 | 4f5c06b1f95fbce95efb57c0badf247d8c6a0c11 |
| SHA256 | aa384329a719c56c3969f9c4db5166bedf5abb8a55e904bb992be0378d151627 |
| SHA512 | 0f92350b7b2a6a75dd90ed648d53750f04c24e6e7751ba75dd9c3f3019656a608b5c21b82eefd3c626d1de634ea03439606fba7cc51535af13c02b8794b1d2fc |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
| MD5 | 4be8adaf33a1f57481cce8789a4b2f8e |
| SHA1 | d51ca58dbda01ef7987c24d23a8801bb5fe10937 |
| SHA256 | 2f429fb17647097b45b6776460f5bcb2afbb45e35b1c59fe1831c8da42a83e95 |
| SHA512 | f631b60560285c9084ceaf32935edb3e5aa7fa036c6585e477b282566b69e9a54836cad84e109e1a8f2f275df65c8b9431b0011c6ecc34a808c2243a3b453a71 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | e90c5dfc2100078c7119436fdc5cae94 |
| SHA1 | 0f55ce1c42fd38d8c1a88d4f3696d68e90ac4a44 |
| SHA256 | 2a84b19bcbd54a13aeebc727cee68e4b2faa73f8e1517ac959cd80d96ef7adbe |
| SHA512 | 2f61f733c0b776182bf830c6e9d1dbdbb5e348f220319be976613086e07de14df9c6ed1c8e365eee8d58701da38196db05eac8cac77c42245569261ca53f7c5e |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe580b65.TMP
| MD5 | cb7278a550ed51efa71c856533fd682c |
| SHA1 | 2c32125291fa3f90db389f710fdc296f272f3f0f |
| SHA256 | 681e4c41ec28efcf30dfb2470bb2e38c47de8282614b46e277ca921e7f30ba16 |
| SHA512 | c199dbfe56160f417c6104d71da0015b8934054896e81ec558a62226b409b3beb9af21243a1d824989ab353a2a0151beedb5f4e520e19d36016e7f8b21172484 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 8d7490b3e7a43db4c3da8bb00ac6b158 |
| SHA1 | c7066fec614d396ae635dff0cc86596139de6e12 |
| SHA256 | 84d62bb842b95a2176f4c7f7e03907e10a514e76ffeb9099c0a2b897637cfea5 |
| SHA512 | 7c030d828e2390385a248512e24301b9471794e921057eb46c4ac4f5c093e1df3a61c1bd94a93541a082b346b1aafd3f69fee51bfeebd6cec88a4f087276dbd1 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.92.1_0\dasherSettingSchema.json
| MD5 | 4ec1df2da46182103d2ffc3b92d20ca5 |
| SHA1 | fb9d1ba3710cf31a87165317c6edc110e98994ce |
| SHA256 | 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6 |
| SHA512 | 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | c21c73ad4eb7485def55ce0643bfec99 |
| SHA1 | 3c33d1a056dbe91521ce14772fcb056f3660fbbd |
| SHA256 | 4c8499fccaf28fa6c00f5b1b3d7f3cc87d9ae2d369eb8af9e6bc731e2acbc775 |
| SHA512 | 8c26108a054572f9c2138df934ecf90774fa3ed2deeba6022158d0d1a87c62fdd9e840fb7c6d551056d11ada13923c7975266985e25a1bd0f6a933fe577eeee9 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
| MD5 | 8e4eacc475d2179c7b4072e12a83a689 |
| SHA1 | 6875f929ed4aeccf931daed90c5cdadc00ebeaf3 |
| SHA256 | a347b25c1ec3fac9cf4091c9e74d52f9f5c17add4e09c86e131db281b24d4601 |
| SHA512 | 10faba39f5c3232b9bfec60e4ca366ce5ac083c1279eb6e63388b7676bea39d7c8bae107c4ea8a0ad130010db4c6817b0146f17e6872263c66270d0829be5063 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
| MD5 | 9571a49a995334cf67e5994b6e0871f7 |
| SHA1 | fea9c606fdf3b161167105f0401eebd9d38b21f3 |
| SHA256 | d386ce6da18fcedc3caea3c557b94e14cb8d19442f75485784a69cf5c92b2c4a |
| SHA512 | afa657bc76e2132a40a6f14bb6621633754c4fb78b7868270964d306fabe6fe770b604a00898d8b065c62aab974be89d274ed9abed704559d71863391eeac278 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | 9d313709edba2a1fa1c4b46cc1836277 |
| SHA1 | 8445637327830a6a4b415b34bb5b90764bf26996 |
| SHA256 | 0cb24c3996d2e12313d9af81c32bac4378df6ff3e6db724a9d1e9d37e5d56d15 |
| SHA512 | 8b4a2682cf9c36ff369eaf58e2c4b17e9337724e0d79f18ecd4e7a16847da50f53836f3a3286e817f03a6e97127ab6169934b82c20d90a552c710362016f67ac |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
| MD5 | 5c6899d577a32af20a35fb6020db2fb6 |
| SHA1 | a19a799d244386c8c38a671a05b7c33ad6025bad |
| SHA256 | 452cbdd9e25d6e4c1d8e9b92841ed4795c166023cadb9fe90916f123ba9df35d |
| SHA512 | 5d8a09042a10c7d7b1456aa1fbc6920ff1697c82698a8f11c1f3e9c3e767fffda031c6c56df7ba46437f814a1fac1cd94312d2e3dfa4653ced2cd6840caa40fe |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
| MD5 | a2a0b5be47dcb01a6acd6be82891f56f |
| SHA1 | 11e3c1e3b5ea47ebbb5243a51f770ff3eee6eef2 |
| SHA256 | f045d9b9fe639af52687f9a409c0f9e6a490da22c91398ec66d1c7c6aeecde9c |
| SHA512 | 691d6b5841402f6cdad4a56b57191d26c2e545acd1d67141e71db6a1077b8340bee7f53c4417cc939e336e5b5ae4a59632c2fd3840420ba715c257c89551465a |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | f90d4d04a251ec4bb2f2089cedac7472 |
| SHA1 | 1465bed681f4a636c3b0e73a85cbfc7eab83bfd5 |
| SHA256 | c6390252a2e1880288ec040b537ae799a1b2f461164a56d1fab00df5157686a5 |
| SHA512 | 75b2f8f84b6cc10a22bd034d5842b9446eeb9cf4350d12c2d0007d6ed2aeecdabece3f64277c07eca549031757c30b0c0262c991f7b95d291b134d97c61c6fea |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
| MD5 | ffeff0dc1d27ec3050ae94ec456a078e |
| SHA1 | c6201046ec9d0a51f0df39f0cd949307815b04a7 |
| SHA256 | 77266d3d40a80e03081cd5af85bf8a884e6708ea4eb49a4c951bce92b1f1b6d6 |
| SHA512 | 881ddfb2c10e9a95318010f24bcf4d7c5197f0fffe75bd7359a1b9dbd33adcf3b7e1f744163238903aa63f62b428a96574f354a1a4f1a151051d1c974d0e5c89 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\e68048ce-3b0d-4bf4-8f09-3cb303038a29.tmp
| MD5 | 37a6b31c25b93a83fd98b737a949d06e |
| SHA1 | f91514353e386ee1505ae93628519fcc2b3f7765 |
| SHA256 | 56ec0ca93b7bcfd2c982007fbc39d69ba7a304b155f318aa5c38e76290fedb42 |
| SHA512 | b8492556f70c423c2e224bf2aaedefea17b81dfc13149be55f5a896a0e9740105977cae33950af62d51906fb9cef264e701f5c88d0a5ecfabf9809ea87c4de25 |
C:\Users\Admin\Downloads\Petya.A.zip
| MD5 | 1559522c34054e5144fe68ee98c29e61 |
| SHA1 | ff80eeb6bcf4498c9ff38c252be2726e65c10c34 |
| SHA256 | e99651aa5c5dcf9128adc8da685f1295b959f640a173098d07018b030d529509 |
| SHA512 | 6dab1f391ab1bea12b799fcfb56d70cfbdbde05ad350b53fcb782418495fad1c275fe1a40f9edd238473c3d532b4d87948bddd140e5912f14aff4293be6e4b4c |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | b21135dacff8174491020700c07220f8 |
| SHA1 | 1c7a90a7f4dda18c55ca0bef149e1f8bd91e608e |
| SHA256 | 4cc310b32f8712a425a304e0d973695d56380899ff1f317dacbf589d41870fa8 |
| SHA512 | 8ade4414ce7bdf8d84279f03d161bc5dc5bdaafb3ed8f96b7f0dc437c3bacb02603eb0f82de4172b88a80bdb434c33bad5e77710f077e446984e468bf30b1d12 |
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
| MD5 | b75f80c5bf5845d4a901c10ab2e5adc8 |
| SHA1 | 1de5aed8490a1c3e10baf202193b36c271f94d13 |
| SHA256 | 33393bd8bc159d7daa463d0e6a76f7afadb369e022f5ae050939a60f0bc88837 |
| SHA512 | a65b6f0e5f27d8442a9679d450edf411dc35bb94366e89a36681f3ee94476dacf15c02a77a47eba57cdf02ba8aac966b1ea254b3e6453aa3b10d849a98083744 |
Analysis: behavioral2
Detonation Overview
Submitted
2025-06-04 17:18
Reported
2025-06-04 17:19
Platform
win11-20250502-en
Max time kernel
0s
Command Line
Signatures
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\SysWOW64\rundll32.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 328 wrote to memory of 820 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 328 wrote to memory of 820 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
| PID 328 wrote to memory of 820 | N/A | C:\Windows\system32\rundll32.exe | C:\Windows\SysWOW64\rundll32.exe |
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\version.dll,#1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 820 -ip 820
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 524