Overview

overview

8

Static

static

3

atom.exe

windows10-2004-x64

8

atom.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/06/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    atom.exe
  • Size 977KB
  • Sample260625-pgq9psby2m
  • SHA256 aef4713c92b89997952f34e1d9a97cc44824fdac17e77d8221b9f70ef877620b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 51 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Service Discovery 1 TTPs 22 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 45 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\atom.exe
    "C:\Users\Admin\AppData\Local\Temp\atom.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5956
    • C:\Users\Admin\AppData\Local\Temp\loader_ldir_240726656\atom.exe
      "C:\Users\Admin\AppData\Local\Temp\\loader_ldir_240726656\atom.exe" --cp
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\atom.exe
        "C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\atom.exe" --arf=1 --rfr=530000 --ga-tid=UA-122680070-1 --ga-cid=GA1.2.833140426.1565808784 --usagestats=1 --ext_params=old_mr1lad=5d9244f53a572f6b-300-2794274_2011415_500755-2794274_2011415_500755&IVID=01kbpD2U2DHs00000L0g94Xs%3A%3A%3A0-0-0 --onboarding-pages=import,privacy,vk,shortcuts,stats
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\CR_745B2.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\CR_745B2.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\CR_745B2.tmp\CHROME.PACKED.7Z" --arf=1 --rfr=530000 --ga-tid=UA-122680070-1 --ga-cid=GA1.2.833140426.1565808784 --usagestats=1 --ext_params=old_mr1lad=5d9244f53a572f6b-300-2794274_2011415_500755-2794274_2011415_500755&IVID=01kbpD2U2DHs00000L0g94Xs%3A%3A%3A0-0-0 --onboarding-pages=import,privacy,vk,shortcuts,stats
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1160
          • C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\CR_745B2.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\CR_745B2.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=9.0.1.16 --annotation=bid={C0348F9A-14A9-466F-9604-5A9A0E1B1A77} --annotation=plat=Win32 --annotation=prod=Atom --annotation=ver=9.0.1.16 --initial-client-data=0x350,0x354,0x358,0x34c,0x35c,0xc93330,0xc93340,0xc9334c
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2144
          • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\explorer.exe
            "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\explorer.exe" pin "C:\Users\Admin\Desktop\Atom.lnk"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            PID:1148
          • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
            "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --installer-launcher --onboarding-pages=import,privacy,vk,shortcuts,stats
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3832
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=9.0.1.16 --annotation=bid={C0348F9A-14A9-466F-9604-5A9A0E1B1A77} --annotation=plat=Win32 --annotation=prod=Atom --annotation=ver=9.0.1.16 --initial-client-data=0x174,0x178,0x17c,0x124,0x180,0x6f2dd9a0,0x6f2dd9b0,0x6f2dd9bc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1608
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1660 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:2864
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=gpu-process --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1680 /prefetch:2
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3304
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1568
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3188
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2476
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2804
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5348
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:6036
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5792
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1212
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2320
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5372 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3428
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4740
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2340
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2916
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4084
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5836
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3144 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5900
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3848
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1500
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=820 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2800
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3028 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:956
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1504,2867061582327234695,11984640709268040803,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP,Marusya,MyAdBlocker,MySearchContext,TabSeparators,WhatsApp --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4808
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3008
    • C:\Windows\System32\CompPkgSrv.exe
      C:\Windows\System32\CompPkgSrv.exe -Embedding
      1⤵
        PID:1720

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Id
            • Path C:\ProgramData\Mail.Ru\Id
            • Size 38B
            • SHA256 1ce4aaa73f199bf59a268ffe2e7a12e8a62ac372997ebf2a1999f039376972fb
            • MD5 SHA1 SHA512
            Submit Download

            0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
            • Size 1KB
            • SHA256 90c4b238a24dfdfd617ebdf00a8207fd654e63f97fd00842329dbc65b1acb36a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7324417735E7E954D4CA6233063D227D
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7324417735E7E954D4CA6233063D227D
            • Size 1KB
            • SHA256 68304e1b1d6920d2fc48f9df8f2c612ca381f123be1b95214dfdb6303b9c45ff
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
            • Size 1KB
            • SHA256 dd6c57f271be6a2a11f56d3fd59a475b9a46debd529095e5296d49f5a58c1bad
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
            • Size 508B
            • SHA256 cb66d9b26be691aa88773d4cf1345eecf73628a3a1f7ea0cd0b65f6a9728c650
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            7324417735E7E954D4CA6233063D227D
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7324417735E7E954D4CA6233063D227D
            • Size 532B
            • SHA256 f8446bc113d37a75f24db2d24af3a07bc60cb6b31e2d5f04034efe7328528640
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3
            • Size 506B
            • SHA256 33ab38292f0f76bd6bb41ddfca5e6dc759a3ab6a1713a0c2a602563791cfe2c1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            chrome_elf.dll
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\9.0.1.16\chrome_elf.dll
            • Size 783KB
            • SHA256 d633376eae00970bbd4da6270066e4473e3a9d55ad34fbe2de1ad0699d68ab91
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libEGL.dll
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\9.0.1.16\swiftshader\libEGL.dll
            • Size 383KB
            • SHA256 ff983916bb009772572e8a716aad1648190348525384690d60f32c3cf55f48de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libGLESv2.dll
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\9.0.1.16\swiftshader\libGLESv2.dll
            • Size 2.7MB
            • SHA256 6ef2ae989aa3dbee6bd1d467e9197ffad012aba85cf8de623750b404931b1970
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            20260625132113.pma
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\SetupMetrics\20260625132113.pma
            • Size 2KB
            • SHA256 a889913ce58a3f71875a5749b24b3e12f095a3e564bbdc8c53b0dd1b407d32d6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            atom.exe
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
            • Size 1.9MB
            • SHA256 840b18b31f9b9803259de0ea7a8ab5b6a7552301251f8d9f9d462d68d5198595
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            explorer.exe
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\explorer.exe
            • Size 224KB
            • SHA256 9955e0ab8cef40fe53ad84e4921fa40f303faad89109dc0393d27709630e5058
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            settings.dat
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad\settings.dat
            • Size 40B
            • SHA256 2db5c4366c24f45145e205bd79bdda9f55d57be7c03fa8672cfe599dd963cf66
            • MD5 SHA1 SHA512
            Submit Download

            11640622-d8c0-469b-94ec-065de241e631.tmp
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\11640622-d8c0-469b-94ec-065de241e631.tmp
            • Size 35KB
            • SHA256 70c9ae31f8416eacfd87c690a834f48476d55f24ffa782fdcb407b7a8269230a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            the-real-index
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
            • Size 2KB
            • SHA256 2caf88b67f6913663af74f665a7982c751c583f7e4fff4981132c1e4bbfcda63
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            the-real-index~RFe5abe7f.TMP
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5abe7f.TMP
            • Size 48B
            • SHA256 7ca08ab69c1e5f230462a547b89c6048fea78ce08e7dd08c15eb3eb615963d53
            • MD5 SHA1 SHA512
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Extensions\pjingpobgnioikhkajmjnflikoghfdnm\2.0.1_0\1.0\https.first.leveldb\CURRENT
            • Size 16B
            • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\IndexedDB\https_vk.com_0.indexeddb.leveldb\MANIFEST-000001
            • Size 23B
            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
            • MD5 SHA1 SHA512
            Submit Download

            MANIFEST-000001
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Local Storage\leveldb\MANIFEST-000001
            • Size 41B
            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
            • MD5 SHA1 SHA512
            Submit Download

            Network Persistent State
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Network Persistent State
            • Size 1KB
            • SHA256 51746cd0cb0a9984e927b4ae1de419759991dd8a33970af3f263f5299de7a552
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
            • Size 4KB
            • SHA256 1b471ff8a58af5a77eb9bccd77e6fd3ee72ff51f6c3ed527658138e2e26b87f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
            • Size 3KB
            • SHA256 a0616e17e670d3e3ecc532ed2f2a1ac769ddb9c0d21da63708131df15b853ca6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
            • Size 4KB
            • SHA256 868d28d5dfb87dcaca53d65ec564c54f0b671803517aa3fdf96909ab838d0e66
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
            • Size 4KB
            • SHA256 6e5267005e2fa2ed6dc4d5c5780ba2e0e3d1af3363c25245432b28785df96058
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Preferences~RFe5a0c46.TMP
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences~RFe5a0c46.TMP
            • Size 3KB
            • SHA256 700a182a636347b722cb00d16164a317706d2af9285e876cb2529251f4c29d1c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            0e33e9cb-6e22-43c0-8427-85e2f29d74f8.tmp
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\0e33e9cb-6e22-43c0-8427-85e2f29d74f8.tmp
            • Size 59B
            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            data_0
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_0
            • Size 8KB
            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_2
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_2
            • Size 8KB
            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            data_3
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_3
            • Size 8KB
            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Sync Data\LevelDB\CURRENT
            • Size 16B
            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
            • MD5 SHA1 SHA512
            Submit Download

            TransportSecurity
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
            • Size 705B
            • SHA256 d106c4b36eb1c46d1a4a721890f2fd0dafa4b1633b50119fce8c74317a4888c0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TransportSecurity~RFe5a7c65.TMP
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity~RFe5a7c65.TMP
            • Size 203B
            • SHA256 0d1d0148816625ecbdece0d70b12da70dc9829f95beb562b4689c8bc778f8351
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            b3d78e07-5740-49b0-b2ba-7a45e7197136.tmp
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\b3d78e07-5740-49b0-b2ba-7a45e7197136.tmp
            • Size 195KB
            • SHA256 5f232a28f2d7ada53a622c84ac72272d1bc02c1252181ff75631d591752d3d93
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CURRENT
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\data_reduction_proxy_leveldb\CURRENT
            • Size 16B
            • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
            • MD5 SHA1 SHA512
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
            • Size 3KB
            • SHA256 e937620314cd896a601354efd222293183ea99d266a25b884ef99e20fa293358
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
            • Size 3KB
            • SHA256 6845bdc52cf82d49ac466cf6fa1f1c246ae9fc8681d8ede38763faea0da50da5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
            • Size 44KB
            • SHA256 63df550b103efcdc1bde1f2eb967e685d595751f37ce0c1e06f918ddb0f2f03a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
            • Size 44KB
            • SHA256 4a3157c5596b22a57ea57d4484b2358845ac6083b018aae83cee548995ceca85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Local State~RFe5a54e8.TMP
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State~RFe5a54e8.TMP
            • Size 3KB
            • SHA256 829425496c11469256b1994550f62e1c56946befabaeb0e347283dc110d18a94
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Module Info Cache
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
            • Size 89KB
            • SHA256 5b699cb31e91734e14dbc8ab4587fb3382381ce697da4df523f5e9ba71e3d849
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Module Info Cache
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
            • Size 89KB
            • SHA256 4dfa0dd7fdb7f481147918baeba680b9bc86b30d17d13fd671848859f837f157
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Module Info Cache~RFe5acb21.TMP
            • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache~RFe5acb21.TMP
            • Size 87KB
            • SHA256 b647ed2d58c79d1e5412e5da3ff80e8094bd248a919e9c7daa6375dc108620c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            atom.exe
            • Path C:\Users\Admin\AppData\Local\Temp\loader_ldir_240726656\atom.exe
            • Size 977KB
            • SHA256 aef4713c92b89997952f34e1d9a97cc44824fdac17e77d8221b9f70ef877620b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setup.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1782390021\CR_745B2.tmp\setup.exe
            • Size 2.4MB
            • SHA256 13fb44bac6f93cbff0ba9de924731ee56389b95bd3053e3954f43feb79c9834e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Atom.lnk
            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Atom.lnk
            • Size 2KB
            • SHA256 987955967e93b2eafc434c4d8efc630660478d3faa358106d1cbbbdda01c023a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Atom.lnk
            • Path C:\Users\Admin\Desktop\Atom.lnk
            • Size 2KB
            • SHA256 d26500928b4f0c609cf20e22d4646ac83a3a7bd7f7c699c8cb69ad29f4945e6f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/1824-8-0x000000006FE1D000-0x000000006FE1E000-memory.dmp
            Download