Overview

overview

8

Static

static

3

atom.exe

windows10-ltsc_2021-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1802s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    14/08/2026, 02:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    atom.exe
  • Size 978KB
  • Sample260814-dfd27stbnb
  • SHA256 51bcbd26b303e340679e3b837780210ecc25fc844427ac93cb905fc21061dc4f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 28 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 61 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • Network Service Discovery 1 TTPs 53 IoCs

    Attempt to gather information on host's network.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 32 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 54 IoCs
  • Modifies system certificate store 2 TTPs 40 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\atom.exe
    "C:\Users\Admin\AppData\Local\Temp\atom.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\loader_ldir_240666656\loader.exe
      "C:\Users\Admin\AppData\Local\Temp\\loader_ldir_240666656\loader.exe" --cp
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\loader.exe
        "C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\loader.exe" --arf=1 --rfr=530000 --ga-tid=UA-122680070-1 --ga-cid= --usagestats=1 --ext_params= "--ntp-settings={\"feedEnable\": true, \"searchEnable\": true, \"historyEnable\": true, \"noteEnable\": true, \"widgetMailEnable\": true, \"widgetOkEnable\": true, \"widgetVkEnable\": true, \"widgetCrownEnable\": false, \"gamePanelEnable\": false, \"trendsSuggestEnable\": true}" --onboarding-pages=import,backgrounds,devices,shortcuts,ntp_settings,security,stats --rmt-onboarding=https://browserdata.cdnmail.ru/atom_welcome_page/v9/page-2-base/ --force-restore-on-startup-last --enable-features=TabSeparators,MyAdBlocker,WhatsApp,TabHoverCardImages,ReaderMode,Marusya --disable-features=MySearchContext
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\CR_CC305.tmp\setup.exe
          "C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\CR_CC305.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\CR_CC305.tmp\CHROME.PACKED.7Z" --arf=1 --rfr=530000 --ga-tid=UA-122680070-1 --ga-cid= --usagestats=1 --ext_params= "--ntp-settings={\"feedEnable\": true, \"searchEnable\": true, \"historyEnable\": true, \"noteEnable\": true, \"widgetMailEnable\": true, \"widgetOkEnable\": true, \"widgetVkEnable\": true, \"widgetCrownEnable\": false, \"gamePanelEnable\": false, \"trendsSuggestEnable\": true}" --onboarding-pages=import,backgrounds,devices,shortcuts,ntp_settings,security,stats --rmt-onboarding=https://browserdata.cdnmail.ru/atom_welcome_page/v9/page-2-base/ --force-restore-on-startup-last --enable-features=TabSeparators,MyAdBlocker,WhatsApp,TabHoverCardImages,ReaderMode,Marusya --disable-features=MySearchContext
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\CR_CC305.tmp\setup.exe
            C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\CR_CC305.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=9.0.1.16 --annotation=bid={959229A7-562E-4F35-9461-A10C8F960441} --annotation=plat=Win32 --annotation=prod=Atom --annotation=ver=9.0.1.16 --initial-client-data=0x338,0x33c,0x340,0x314,0x344,0x663330,0x663340,0x66334c
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3456
          • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\explorer.exe
            "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\explorer.exe" pin "C:\Users\Admin\Desktop\Atom.lnk"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            PID:1520
          • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
            "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --installer-launcher --enable-features=TabSeparators,MyAdBlocker,WhatsApp,TabHoverCardImages,ReaderMode,Marusya --disable-features=MySearchContext --onboarding-pages=import,backgrounds,devices,shortcuts,ntp_settings,security,stats --ntp-settings="{\"feedEnable\": true, \"searchEnable\": true, \"historyEnable\": true, \"noteEnable\": true, \"widgetMailEnable\": true, \"widgetOkEnable\": true, \"widgetVkEnable\": true, \"widgetCrownEnable\": false, \"gamePanelEnable\": false, \"trendsSuggestEnable\": true}" --rmt-onboarding=https://browserdata.cdnmail.ru/atom_welcome_page/v9/page-2-base/ --force-restore-on-startup-last
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2988
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=9.0.1.16 --annotation=bid={959229A7-562E-4F35-9461-A10C8F960441} --annotation=plat=Win32 --annotation=prod=Atom --annotation=ver=9.0.1.16 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x6fd4d9a0,0x6fd4d9b0,0x6fd4d9bc
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:4824
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1620 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • Modifies trusted root certificate store through registry
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              PID:4480
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=gpu-process --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1648 /prefetch:2
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1040
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4484
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1864
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:824
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4504
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3788
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4684
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2028
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3648
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4348
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5424 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2740
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3080
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1328
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4040
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1104
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7668 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5144
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3044 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5188
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3064 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5240
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8000 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5296
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7476 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5584
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5564
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1408
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:8
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              PID:4852
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4728
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1504
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7952 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1032
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7916 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2472
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7360 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4812
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5356 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1248
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=gpu-process --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=7316 /prefetch:2
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5256
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=updater.mojom.UpdateService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4756
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5140 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3540
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1500 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5640
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=ppapi-broker --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=2172 /prefetch:4
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3376
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=updater.mojom.UpdateService --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7796 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5436
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4784 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5556
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7692 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3432
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7724 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5648
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:6060
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8064 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4328
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2944
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4220 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4632
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5408
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3820
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2204
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
              6⤵
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4640
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2812
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3012 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1880
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7780 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1984
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:7060
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1596
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5892
            • C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
              "C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=renderer --field-trial-handle=1608,2522916936609639407,55537894679447123,131072 --enable-features=Marusya,MyAdBlocker,ReaderMode,TabHoverCardImages,TabSeparators,VkMusic,VkNotify,WhatsApp --disable-features=Channel,Dashboard,LocationBarPIP,MySearchContext --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3624
  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    1⤵
      PID:5800
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        2⤵
        • Drops desktop.ini file(s)
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:5752
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27100 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2076 -initialChannelId {40f331bc-3b1b-47f4-b943-9c81f856e434} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
          3⤵
            PID:4380
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2432 -prefsLen 27136 -prefMapHandle 2436 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {72204055-b3f2-43ab-8064-9e7c9ffc7419} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
            3⤵
              PID:5576
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3808 -prefsLen 27277 -prefMapHandle 3812 -prefMapSize 270279 -jsInitHandle 3816 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3824 -initialChannelId {809cb29a-23e7-4386-b2d7-18ac2f21caaa} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
              3⤵
              • Checks processor information in registry
              PID:5560
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27277 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {4258d459-9554-42d3-bc0a-25dfb101b81c} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
              3⤵
                PID:1364
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3084 -prefsLen 34776 -prefMapHandle 3036 -prefMapSize 270279 -jsInitHandle 3096 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2792 -initialChannelId {d1f6f952-96b1-4446-a928-6e460b1e3e2a} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                3⤵
                • Checks processor information in registry
                PID:4868
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 35013 -prefMapHandle 5040 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {a26eda17-48a4-4e25-8a44-98946fe65dbf} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                3⤵
                • Checks processor information in registry
                PID:4160
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 32900 -prefMapHandle 5356 -prefMapSize 270279 -jsInitHandle 5360 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5336 -initialChannelId {050a86f3-0598-43c2-b87b-f049c588f92a} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                3⤵
                • Checks processor information in registry
                PID:3744
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5384 -prefsLen 32900 -prefMapHandle 5388 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5396 -initialChannelId {2312e8a3-cbf8-4055-a97b-55a288f0a32a} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                3⤵
                • Checks processor information in registry
                PID:6064
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5684 -prefMapSize 270279 -jsInitHandle 5680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4968 -initialChannelId {bb46f25d-323b-4045-b381-bd809a5fd9fe} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                3⤵
                • Checks processor information in registry
                PID:2660
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 30904 -prefsLen 37187 -prefMapHandle 27480 -prefMapSize 270279 -jsInitHandle 27616 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 30220 -initialChannelId {6e05134d-38a8-4ef0-848e-50daa52da863} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
                3⤵
                • Checks processor information in registry
                PID:2248
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 35476 -prefsLen 37187 -prefMapHandle 23796 -prefMapSize 270279 -jsInitHandle 35472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 31824 -initialChannelId {026e7a7a-d775-4b5b-82d2-0f46d46ea0af} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
                3⤵
                • Checks processor information in registry
                PID:6748
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 31708 -prefsLen 37187 -prefMapHandle 31700 -prefMapSize 270279 -jsInitHandle 31696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 35388 -initialChannelId {ea30ec2b-cb96-4dfe-b8a5-b82f694268cf} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
                3⤵
                • Checks processor information in registry
                PID:2684
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5352 -prefsLen 37187 -prefMapHandle 5464 -prefMapSize 270279 -jsInitHandle 5392 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 35280 -initialChannelId {f62a164a-6412-4c14-b385-9f647055b13f} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
                3⤵
                • Checks processor information in registry
                PID:5220
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 29196 -prefsLen 37187 -prefMapHandle 5068 -prefMapSize 270279 -jsInitHandle 35204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 27436 -initialChannelId {3472fbc8-51f4-4e4b-8eda-961b3cb49784} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
                3⤵
                • Checks processor information in registry
                PID:6932
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 1 -prefsHandle 33644 -prefsLen 40405 -prefMapHandle 33688 -prefMapSize 270279 -ipcHandle 30148 -initialChannelId {f65468dd-3179-4a40-86f4-80e8d09949a2} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 utility
                3⤵
                • Checks processor information in registry
                PID:1100
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 2 -prefsHandle 35272 -prefsLen 40405 -prefMapHandle 35184 -prefMapSize 270279 -ipcHandle 27484 -initialChannelId {94a65687-a778-45b7-9b73-4870eb54ca4a} -parentPid 5752 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5752" -appDir "C:\Program Files\Mozilla Firefox\browser" - 16 utility
                3⤵
                • Checks processor information in registry
                PID:3868

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                Id
                • Path C:\ProgramData\Mail.Ru\Id
                • Size 38B
                • SHA256 3ea6b05660c9aa47deffd04a4f8c8996db1ffd9642d0bffbb1a855f54a1a4072
                • MD5 SHA1 SHA512
                Submit Download

                chrome_elf.dll
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\9.0.1.16\chrome_elf.dll
                • Size 783KB
                • SHA256 d633376eae00970bbd4da6270066e4473e3a9d55ad34fbe2de1ad0699d68ab91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libEGL.dll
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\9.0.1.16\swiftshader\libEGL.dll
                • Size 383KB
                • SHA256 ff983916bb009772572e8a716aad1648190348525384690d60f32c3cf55f48de
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libGLESv2.dll
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\9.0.1.16\swiftshader\libGLESv2.dll
                • Size 2.7MB
                • SHA256 6ef2ae989aa3dbee6bd1d467e9197ffad012aba85cf8de623750b404931b1970
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                atom.exe
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe
                • Size 1.9MB
                • SHA256 840b18b31f9b9803259de0ea7a8ab5b6a7552301251f8d9f9d462d68d5198595
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                explorer.exe
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\Application\explorer.exe
                • Size 224KB
                • SHA256 9955e0ab8cef40fe53ad84e4921fa40f303faad89109dc0393d27709630e5058
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Category Switch
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Category Switch
                • Size 33B
                • SHA256 0afde5199fd0d889a5855f0997d2bf4fbc0b35f151548ca9d047898a16709663
                • MD5 SHA1 SHA512
                Submit Download

                settings.dat
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad\settings.dat
                • Size 40B
                • SHA256 151fa40542e30c320bb843d41b39b4a3d40ce06378dfa4c56181e7b662c6a917
                • MD5 SHA1 SHA512
                Submit Download

                0a1cc98e-cc27-4749-b630-dcf613b8b616.tmp
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\0a1cc98e-cc27-4749-b630-dcf613b8b616.tmp
                • Size 5KB
                • SHA256 ce120995c87852246c16cc278a192463ec146584116554167f0005af8ad0e096
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                0cb78b99-5224-4e41-bee5-1c1d4d4c4706.tmp
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\0cb78b99-5224-4e41-bee5-1c1d4d4c4706.tmp
                • Size 59B
                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                2027ead4-8334-4649-9b61-5270d729d516.tmp
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\2027ead4-8334-4649-9b61-5270d729d516.tmp
                • Size 195KB
                • SHA256 5f232a28f2d7ada53a622c84ac72272d1bc02c1252181ff75631d591752d3d93
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                71b7f2dc-9d45-477b-acdd-3391996deec1.tmp
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\71b7f2dc-9d45-477b-acdd-3391996deec1.tmp
                • Size 35KB
                • SHA256 bd7ef7d45de8141938ba50dc0d3f6ed5e9661a13d549daad1ac3140a2f1e043d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00004e
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00004e
                • Size 85KB
                • SHA256 0e3c76371785d00d0946ea6b30e8276e44892ebddddf53b3ec155b392030312c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00004f
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00004f
                • Size 17KB
                • SHA256 a4f9e6780211de3092b0b5c93cac9bc98cc1e030047fcc2fdb581e7065c691b1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000050
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_000050
                • Size 17KB
                • SHA256 8ca93f13bfedb14136e1d18fb42ce5304e35abb63b5823befed55a9905570d2b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000051
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_000051
                • Size 104KB
                • SHA256 237ec56622cf5a42f50349bca10c1a76fd52929aaf7a5d87dff8561302a1e734
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000057
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_000057
                • Size 82KB
                • SHA256 481d373e73c0ea8f57c4965b8d8b3b11d36303710938b4ded6515c1be244d13e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000059
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_000059
                • Size 49KB
                • SHA256 5b50e48d094c8b1eaa96b7aafc2a7746406c38831cd5f1358fff2f1632b2c834
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00005a
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00005a
                • Size 25KB
                • SHA256 9e54337eab93593633c9cd1650c95401937d926705d7d1008379b76087bc6abd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00005b
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00005b
                • Size 124KB
                • SHA256 3a11d79d9421bcfb86e84496b6db5da891cbc91c45f214baff84784cfef2b741
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00005e
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00005e
                • Size 36KB
                • SHA256 da88ec9a432291217dba6a7f469a773a1f1c907627fa17a37a00a9c03bee1285
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00005f
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00005f
                • Size 34KB
                • SHA256 64975070570dbd6b8d23bb065262a97f841b7a6bf0a6aa9f91a647b329c53e92
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000060
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_000060
                • Size 23KB
                • SHA256 29f0c7df8084f31966984ce8f1b15197d21eede9ed6c51c8d149bea049dc6760
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_000067
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_000067
                • Size 21KB
                • SHA256 2b904ffaee28de0fc214b9f8a32c23003f736720a633b78b9ca8c7f5ac98a314
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_00006b
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00006b
                • Size 20KB
                • SHA256 cc61635da46b2c9974335ea37e0b5fd660a5c8a42a89b271fa7ec2ac4b8b26f6
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                f_00006d
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_00006d
                • Size 104KB
                • SHA256 b01c3248f93fbca91916743b8419f2e265d61a6a64e3f2bc1da3152858a9b4ff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                f_0000bc
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Cache\f_0000bc
                • Size 239KB
                • SHA256 bdda6358c74abf62e5fa4ddc16bd6f993e982a9009fd7675e2244e6e5ab79d4f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                temp-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\temp-index
                • Size 48B
                • SHA256 be34c729aafd816ded14a7315b2aa72ae026cf81b9d7c8e487dd94b2458e244b
                • MD5 SHA1 SHA512
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 4KB
                • SHA256 28ea967eb23e52913fc26345410a0effa7bbe401e4da0b7be8e31338c85bc562
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 2KB
                • SHA256 882be9da890b2f9103ec3b056e602c40f5f962165985cef966c6c52192bcab5a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 6KB
                • SHA256 c139fedaa54853950893366fe8733c78d27fe097a62929ee7587bed3eae41a6b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 4KB
                • SHA256 005fc00136fe50f0ef708fe2aeb763bebe0ababb7c31557a4f851b8fd92a77bc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 7KB
                • SHA256 433a5546fe2266a0dfe8931082745c9ed0367b7a076144ca4fb9c6ae72a0ece9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                the-real-index
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Code Cache\js\index-dir\the-real-index
                • Size 7KB
                • SHA256 f64d452572895816b7892ca107af2b553a150d002908543132ab3c15b351f71a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Extensions\pjingpobgnioikhkajmjnflikoghfdnm\2.0.1_0\1.0\https.first.leveldb\CURRENT
                • Size 16B
                • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                • MD5 SHA1 SHA512
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\IndexedDB\https_vk.com_0.indexeddb.leveldb\MANIFEST-000001
                • Size 23B
                • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                • MD5 SHA1 SHA512
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Local Storage\leveldb\CURRENT
                • Size 16B
                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                • MD5 SHA1 SHA512
                Submit Download

                MANIFEST-000001
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Local Storage\leveldb\MANIFEST-000001
                • Size 41B
                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                • MD5 SHA1 SHA512
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Network Persistent State
                • Size 2KB
                • SHA256 2361769ac544df8d75dfc257c5026397b77c7634259ec249a6a98222628d8135
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Network Persistent State
                • Size 59B
                • SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Network Persistent State
                • Size 2KB
                • SHA256 c4a96115534a077d6c0db2ee6f49f9bc499dd6c19e706b67e4750b981fc76832
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Network Persistent State
                • Size 6KB
                • SHA256 2e84b709011082bff61bab421ce10017b95a98013d35e639e6b32028a1c4aeaa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Network Persistent State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Network Persistent State
                • Size 2KB
                • SHA256 41e63808c298dc4ea70e52f61f8e687e1d113708ee30da430229198a2fe9ac76
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 7KB
                • SHA256 d0facbc65cc6e7e3cac851a12c7fa84e78160d5fd2799043bfaab04ce35e15e1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 7KB
                • SHA256 9f84d85d58b21c87d27e105cbe33d952daecba21f32e612f070a6894cf65394b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 6KB
                • SHA256 4c8ac3476a53d30624a0245ba083f399ff1f28068ad1d7cb4a4d7edf864bed8f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 5KB
                • SHA256 1c7f6461daac710c7d25e6a649fea8e3fb0d23dade7c17a5f96132f25b84e6e4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 7KB
                • SHA256 8b32c188bb9a9d862cabf9372f212af72796232ab271b3742ccb4897f3de8858
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 7KB
                • SHA256 ec996c53f3a85d1e7f709cb654b0e26abfbe861eef2c6de49ce7f5dfbde8d54c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 7KB
                • SHA256 b23bc9719aa27d33c6c9934c275c494f901c439409ab66a7784e42904201521d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 7KB
                • SHA256 8b0ad3a88e26023aa569c018435f3de0f0983ef82fb21ae53a0cc9cd2417c169
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Preferences
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Preferences
                • Size 8KB
                • SHA256 4db3344b56f040435a1d4a63ee8547da81c76eb5be0d7eb49db72efddd287cd2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data_0
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_0
                • Size 8KB
                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_1
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1
                • Size 264KB
                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_2
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_2
                • Size 8KB
                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                data_3
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_3
                • Size 8KB
                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 e1463d605046e04638bbf4ff464e5177893a95db27553db6302b4a930512fed3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 4c143f32d6fa1ca88bdad7e745754cf522c895c96a9c542888ddd2e80b22ad44
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 1KB
                • SHA256 41b9adcfc3b396e727cbc0ee383d2e12115a71e5435075431fe94a2ccdf39de9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 765d597e18139d59aafc0615297dadf5f85e63c1eb4a24c2589346492cb9c86a
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 301efd95577129e5802cb8ee3255ba480a02b5f7665afde8a12a5083388fb6be
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 3cb02e9bf2f45f99896c4e2559de4da29aa5f6f134d8367a487b2bdf6e5fdaaf
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 4KB
                • SHA256 8d5a199dc3e8eb882ef9f465f4713acca3c9160d674fe17db9d374c81d715fcf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 5KB
                • SHA256 ea587ecb2a08c62e9ec5d6b5703f06010063490f6d9f763bc8db8841364c1518
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 02465dfe9161eaedb250249e4c1fb460d2ab1da5da13f8c6ae30f17d9fedd3df
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 e1741e67bbeb15ba9984e01788c453fd2f18b6c62aef29038eb0c72233eae66c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 ed930ce4c28b516ede61f0334e2646c2adbe43fabee4a046ac8048c2ce5aa374
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 99a12b54184220457e9b38e4780c37b523ad545540a50a65ae211e4305c40ea6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 cc95e5cf63484c3c57f75f03ae51088dac962a95c50da56acff0e3eace8422fb
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 b05ea656c95f3044071ba667d1f3cb882db194d99c6c247addf6b32bbf269ee1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 f2b8fe04dad2d5e350040e90836dff47b56bb530d7fdcd43c40926b9fe4e94b4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 0fc0cf3e0b467539e5236b3508d2626987df1a20ae0ba2916fbd30723c60cba3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 b80cf06e501b4e389bb21261548c69571b6689617f592d9f8380da29b479b4fe
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 4KB
                • SHA256 cd1da8acd7dcd4e14786f0b4a3a28d10afa513873014cdd14a904e6c45c67544
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                TransportSecurity
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity
                • Size 3KB
                • SHA256 e0a49cf1ee2709452b5b2a72ead5996e2f956e2bfb65c4291009e1cb4f64f1f7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                TransportSecurity~RFe593b2b.TMP
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\TransportSecurity~RFe593b2b.TMP
                • Size 1KB
                • SHA256 65b91f3770b797fa831b225efe19cd7f5906345578c074dc4cadce81d49be23c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                CURRENT
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                • Size 16B
                • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                • MD5 SHA1 SHA512
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
                • Size 4KB
                • SHA256 89fc73ed5d4c4c471929433925ed16a501eb2a3b8801976f5c32e648dbbfc782
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
                • Size 4KB
                • SHA256 8dbe9950af0d831c62f3d13d9a4ba4555295433cd1372d277dd0ae9609aea1d2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
                • Size 57KB
                • SHA256 1a681711fd4d21f0355a37dee6c7ab9250aff537f72673c544fc35c9fe831d42
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Local State
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State
                • Size 3KB
                • SHA256 cc737630bb7b4997f736f4098ab1f9bcd78171f42c51d50a1ef2114f8af8453c
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Local State~RFe593195.TMP
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Local State~RFe593195.TMP
                • Size 3KB
                • SHA256 025cd965290a0298f1786226230d8429477a2ab678a911481d565c3edda4b34d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Module Info Cache
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
                • Size 98KB
                • SHA256 c5b662a0954634a5b013433a9902f4fd1997267ca37122136cf152ca2a2c3240
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Module Info Cache
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
                • Size 97KB
                • SHA256 46a9bcb4f888f7712f1d600cbe3683af87aa005eda695cd52e9923cab5f0de07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Module Info Cache
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
                • Size 96KB
                • SHA256 dfd0797a75e098eeb92a8bebe4c2437d8158109b0e30865df997331e4f4765c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Module Info Cache
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
                • Size 101KB
                • SHA256 fccdf42a694f869d18fb841ae4a1237bbe6996f0ae53acfa59e6fa0b2f6b6343
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Module Info Cache
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache
                • Size 104KB
                • SHA256 04d0f4f8f845824bd0aa569fcbe2cecda8f6ec95e0427cb0d37d3a29e9be0a9e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Module Info Cache~RFe599c36.TMP
                • Path C:\Users\Admin\AppData\Local\Mail.Ru\Atom\User Data\Module Info Cache~RFe599c36.TMP
                • Size 94KB
                • SHA256 73b3d8bc932b2ce139042e37912df0256b37c635f0f2e6ba2a77b16e35291b9b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                activity-stream.contile.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\activity-stream.contile.json
                • Size 5KB
                • SHA256 7b806c07f8fe3b21d4e2bc5595b179dd9af7827a001efc9c00585928e13fb077
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                activity-stream.discovery_stream.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\activity-stream.discovery_stream.json
                • Size 77KB
                • SHA256 10c0448c14ba20726294610659192a0f790d3ef51264045d9b0a450a18f6e570
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4B17E3BD56546A615D21318DE29C2AACE21C0577
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\4B17E3BD56546A615D21318DE29C2AACE21C0577
                • Size 63KB
                • SHA256 074f7a5b5ddb11fce9f81819f77fef44d4e0f6d6f175fc7d4b8c669d6c0cf95a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                4D1E0A10A2B223987AA489BE6A35697B27A17D00
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\4D1E0A10A2B223987AA489BE6A35697B27A17D00
                • Size 236KB
                • SHA256 eede0cad4e2eb7a258b7c87bfb52657a2c6cb371d548a451a5ad104fc41c986b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                541C6BD06FD975D814FC874723855E5C178859F2
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\541C6BD06FD975D814FC874723855E5C178859F2
                • Size 344KB
                • SHA256 578cb4aaa5b28a1b5672f8c660f43ee9a09e800783a4c9df4adb495620bdb06f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                77F3FDA78C9C8ED223188DE60562117F0CE71D93
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\77F3FDA78C9C8ED223188DE60562117F0CE71D93
                • Size 63KB
                • SHA256 461c43b4ae93a7dd4896a1781dd542e2aaa5c313ae5be0f6b73ceddae89141ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
                • Size 16KB
                • SHA256 d913378c5229175877a0574ac6bd9a123846d76fa6e3b94d22eb5972c52f3d0a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                A8912450FA18F6DFEA3E18DD13ADFCF53736CF95
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\cache2\entries\A8912450FA18F6DFEA3E18DD13ADFCF53736CF95
                • Size 16KB
                • SHA256 5be4f8eb36e210dbdfde06582e8f45ab24b495f396be48598effef600f7356ce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                qiub9n6NIL_VB933cDJ20ZqvTf43eVKFBjlIYht2UZc=.ico
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\jumpListCache\qiub9n6NIL_VB933cDJ20ZqvTf43eVKFBjlIYht2UZc=.ico
                • Size 691B
                • SHA256 6574e6e55f56eca704a090bf08d0d4175a93a5353ea08f8722f7c985a39a52c8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                nb_model_build_attachment_arts_and_entertainment.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_arts_and_entertainment.json
                • Size 67KB
                • SHA256 960065cc44a09bef89206d28048d3c23719d2f5e9b38cfc718ca864c9e0e91e9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_autos_and_vehicles.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_autos_and_vehicles.json
                • Size 44KB
                • SHA256 022f9495f8867fea275ece900cfa7664c68c25073db4748343452dbc0b9eda17
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_beauty_and_fitness.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_beauty_and_fitness.json
                • Size 33KB
                • SHA256 eed46e8fe6ff20f89884b4fc68a81e8d521231440301a01bb89beec8ebad296b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_blogging_resources_and_services.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_blogging_resources_and_services.json
                • Size 33KB
                • SHA256 c9f2a779dba0bc886cc1255816bd776bdc2e8a6a8e0f9380495a92bb66862780
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_books_and_literature.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_books_and_literature.json
                • Size 67KB
                • SHA256 df23a5b6f583ec3b4dce2aca8ff53cbdfadfd58c4b7aeb2e397eade5ff75c996
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_business_and_industrial.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_business_and_industrial.json
                • Size 45KB
                • SHA256 8410809ebac544389cf27a10e2cbd687b7a68753aa50a42f235ac3fc7b60ce2c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_computers_and_electronics.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_computers_and_electronics.json
                • Size 45KB
                • SHA256 ab20b97406b0d9bf4f695e5ec7db4ebad5efb682311e74ca757d45b87ffc106b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_finance.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_finance.json
                • Size 33KB
                • SHA256 384bf5fcc6928200c7ebb1f03f99bf74f6063e78d3cd044374448f879799318e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_food_and_drink.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_food_and_drink.json
                • Size 67KB
                • SHA256 905357002f2eced8bba1be2285a9b83198f60d2f9bb1144b5c119994f2ec6e34
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_games.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_games.json
                • Size 44KB
                • SHA256 35e67835a5cf82144765dfb1095ebc84ac27d08812507ad0a2d562bf68e13e85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_health.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_health.json
                • Size 33KB
                • SHA256 150f21c4f60856ab5e22891939d68d062542537b42a7ce1f8a8cec9300e7c565
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_hobbies_and_leisure.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_hobbies_and_leisure.json
                • Size 67KB
                • SHA256 47db7797297a2a81d28c551117e27144b58627dbac1b1d52672b630d220f025d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_home_and_garden.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_home_and_garden.json
                • Size 33KB
                • SHA256 19edd15ebce419b83469d2ab783c0c1377d72a186d1ff08857a82bca842eea54
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_internet_and_telecom.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_internet_and_telecom.json
                • Size 67KB
                • SHA256 e646d43505c9c4e53dbaa474ef85d650a3f309ccf153d106f328d9b6aeb66d52
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_jobs_and_education.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_jobs_and_education.json
                • Size 33KB
                • SHA256 29080288b2130a67414ecb296a53ddd9f0a4771035e3c1b2112e0ce656a7481a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_law_and_government.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_law_and_government.json
                • Size 68KB
                • SHA256 257ee9a218a1b7f9c1a6c890f38920eb7e731808e3d9b9fc956f8346c29a3e63
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_online_communities.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_online_communities.json
                • Size 67KB
                • SHA256 11b6084552e2979b5bc0fd6ffdc61e445d49692c0ae8dffedc07792f8062d13f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_people_and_society.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_people_and_society.json
                • Size 45KB
                • SHA256 4990a5d17bea15617624c48a0c7c23d16e95f15e2ec9dd1d82ee949567bbaec0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_pets_and_animals.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_pets_and_animals.json
                • Size 44KB
                • SHA256 dd537bfb1497eb9457c0c8ecbd2846f325e13ddef3988fd293a29e68ab0b2671
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_real_estate.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_real_estate.json
                • Size 67KB
                • SHA256 efcf6b2d09e89b8c449ffbcdb5354beaa7178673862ebcdd6593561f2aa7d99a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_reference.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_reference.json
                • Size 56KB
                • SHA256 3619daa64036d1f0197cdadf7660e390d4b6e8c1b328ed3b59f828a205a6ea49
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_science.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_science.json
                • Size 56KB
                • SHA256 9606ce3988b2d2a4921b58ac454f54e53a9ea8f358326522a8b1dcc751b50b32
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_shopping.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_shopping.json
                • Size 67KB
                • SHA256 bfd7e68ddca6696c798412402965a0384df0c8c209931bbadabf88ccb45e3bb6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_sports.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_sports.json
                • Size 56KB
                • SHA256 44da98b03350e91e852fe59f0fc05d752fc867a5049ab0363da8bb7b7078ad14
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                nb_model_build_attachment_travel.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\nb_model_build_attachment_travel.json
                • Size 67KB
                • SHA256 4336ac211a822b0a5c3ce5de0d4730665acc351ee1965ea8da1c72477e216dfa
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recipe_attachment.json
                • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\personality-provider\recipe_attachment.json
                • Size 1KB
                • SHA256 fc07d42847eeaf69dcbf1b9a16eb48b141c11feb67aa40724be2aee83cb621b7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                80f14831-06d3-4f18-9d10-1d035060696d.zip
                • Path C:\Users\Admin\AppData\Local\Temp\80f14831-06d3-4f18-9d10-1d035060696d.zip
                • Size 3.8MB
                • SHA256 0c21f80ad1b3796c49429949e6a3d52cbe9c3b5b4c317690a749d80076396d0c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                loader.exe
                • Path C:\Users\Admin\AppData\Local\Temp\loader_ldir_240666656\loader.exe
                • Size 978KB
                • SHA256 51bcbd26b303e340679e3b837780210ecc25fc844427ac93cb905fc21061dc4f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.exe
                • Path C:\Users\Admin\AppData\Local\Temp\mini_loader_scoped_dir_1786676230\CR_CC305.tmp\setup.exe
                • Size 2.4MB
                • SHA256 13fb44bac6f93cbff0ba9de924731ee56389b95bd3053e3954f43feb79c9834e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                remote-settings-startup-bundle-
                • Path C:\Users\Admin\AppData\Local\Temp\remote-settings-startup-bundle-
                • Size 562KB
                • SHA256 191e99c1d5a5155c1100ac6eabbad91ab1c61aaf8a3556529c645a02b1b26765
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmpaddon
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 502KB
                • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                tmpaddon
                • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                • Size 11KB
                • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                6824f4a902c78fbd.customDestinations-ms
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 21KB
                • SHA256 abf562149ce78aa6c5b9ec1ef1e665ccd3c868a113dcdfe207f036c8dccda7d7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                6824f4a902c78fbd.customDestinations-ms
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                • Size 24KB
                • SHA256 ca966763be6564db1c9e84e4f154366c4e15649be72b670cfac73edd4113d4a1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                8161d9a419cb6d2.customDestinations-ms
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8161d9a419cb6d2.customDestinations-ms
                • Size 11KB
                • SHA256 2a8893b07c43fb1dd47a3582d5f363889a2e2e9819b56a55b61954900d5688a2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                8161d9a419cb6d2.customDestinations-ms
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8161d9a419cb6d2.customDestinations-ms
                • Size 9KB
                • SHA256 462f903918921076a80724a781fd62f830c0553926ef33ced9e9cbb2414fabbd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Atom.lnk
                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Atom.lnk
                • Size 2KB
                • SHA256 f0d37e5cd0c428ed0d5433c20c9830268801bd51a91c9c870ecc68bdea63abf4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                AlternateServices.bin
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
                • Size 22KB
                • SHA256 4aa183ff072ef33f02169f12e7f22c4c5133dd96d2a1200cb99b6bd1cbeb9683
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                AlternateServices.bin
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\AlternateServices.bin
                • Size 10KB
                • SHA256 0e94a4f7a9200c67d4597bf4ea01311cb8dab0535e049e1a8891fdb1dd79d159
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                SiteSecurityServiceState.bin
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\SiteSecurityServiceState.bin
                • Size 5KB
                • SHA256 878256beae938ff8b114e8b2ecae73d179a6a27a11206ac4141a996691423cd9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bookmarks-2026-08-14_10_3sJMHb5p0_0ujddyZSGywRFwLnn2-1wd80u-Dm-sdlU=.jsonlz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\bookmarkbackups\bookmarks-2026-08-14_10_3sJMHb5p0_0ujddyZSGywRFwLnn2-1wd80u-Dm-sdlU=.jsonlz4
                • Size 853B
                • SHA256 5787722bba0f0b6be4577253832782189cf1f2e42e9f5bc473858229e6fcfc8b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 25KB
                • SHA256 301200ea022f27f4834c014fc5ec6bcc30950f083523479999aa0e3494c687f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 25KB
                • SHA256 2356170efead0a2cd420b187ad6ca7a05c4fd897bddd4c6427a718ca51f7e69d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 25KB
                • SHA256 5cd2b487151f1e2e7513d4e73139bf085e12e5502939d43084c4ec1412618adc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 114KB
                • SHA256 e51f09c225e582ef90f5ba67e2e26dbfe052bf9e6d31e95693756b6f11ae5170
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 114KB
                • SHA256 8a404df3aa790e961e6ccc764f07ea6042bb02bd0d169e6bc512a06c1dc32da2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 122KB
                • SHA256 fa8316c1db6473fdba3f974510093569f105e3ddeab6dc83218c5a234db20adc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 124KB
                • SHA256 0b428560b3f5e86239ca0a2356ddbd3acfcdf05101f06bb1b197a54b7f797ade
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 114KB
                • SHA256 0072dff483cbadbdde7e132315d744796fea1610aa8a1a65d54216a84600a576
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data.safe.tmp
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\db\data.safe.tmp
                • Size 6KB
                • SHA256 c53574b041c75461bc52a6ae4f46effc578568f93e626ff98d10b637364b334a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                events
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
                • Size 1KB
                • SHA256 b0a603baf4537387987adde433d2447ea50d08c8bd5e6ff794c90c92d2a5024e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                events
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\events\events
                • Size 5KB
                • SHA256 a41c07dc1200e333e1f56393a16b5e456bfefd5fb564d3183bdf05412082dd59
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                1f1b04f3-5184-444a-aaa5-bdee70167af8
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\1f1b04f3-5184-444a-aaa5-bdee70167af8
                • Size 235B
                • SHA256 6479d3750efb8a007ee752178b894ad879b557d24a808d83e37d72f32b9c83e2
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                6126ea05-d41b-4de6-ac65-c3562c3b80f2
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\6126ea05-d41b-4de6-ac65-c3562c3b80f2
                • Size 235B
                • SHA256 2dbfb70beef6d93de1b8a69a49ee590f7149b14d25de3ac2073591c0a9cd62d4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                7093e1ce-22fd-450a-9745-35f6e3eb40fe
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\7093e1ce-22fd-450a-9745-35f6e3eb40fe
                • Size 1008B
                • SHA256 4b240110db6602d016a6c35f37eaa82ce0b6e671a3d481becf0c1a499b1889c9
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                9b07067f-8256-41d3-b3cd-7f96f66be39b
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\9b07067f-8256-41d3-b3cd-7f96f66be39b
                • Size 8KB
                • SHA256 0d112b499f1fecf29d8d8beacfd19b22c6daf7bb306ca4db5da2751749624e1f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                a5bbe59d-1e3c-4a5e-ba08-5dca73993240
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\a5bbe59d-1e3c-4a5e-ba08-5dca73993240
                • Size 15KB
                • SHA256 392a008746e56a268d64e1a66cd027f33131e6d14b241aba584779f282b5bbbc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                be9f005b-1e38-4231-ba85-e23619286d92
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\be9f005b-1e38-4231-ba85-e23619286d92
                • Size 883B
                • SHA256 3bf91e31bdcdf46b14d8f169b2dcb9c2ce346d44e4872fb6440cb3244f68028e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                df046e0d-4eb5-4327-8aa8-6081cf7666af
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\df046e0d-4eb5-4327-8aa8-6081cf7666af
                • Size 886B
                • SHA256 c350128098f1886ceaca803c417d437807d3f057475044762884acd3ce0b5d26
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                e82fb16c-f399-49a1-b630-3857b762e0c0
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\e82fb16c-f399-49a1-b630-3857b762e0c0
                • Size 281B
                • SHA256 5d93f66a0e2b053208e36bdb04e07c179bcc7d98eb201e325a66caa2f90d94b3
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                fbd6cc03-042b-4212-9727-15da034f7772
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\datareporting\glean\pending_pings\fbd6cc03-042b-4212-9727-15da034f7772
                • Size 2KB
                • SHA256 5e5f0ca85d66349da80b3ce2711da96955048139d5c20a3bd901269005803235
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                extensions.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\extensions.json
                • Size 16KB
                • SHA256 0dfa1638d5cee5854deb32f8735065340e5195788802ebcd67b913787bfc9e86
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gmpopenh264.dll
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                • Size 1.1MB
                • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                gmpopenh264.info
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                • Size 116B
                • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                manifest.json
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
                • Size 1002B
                • SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                widevinecdm.dll
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
                • Size 21.6MB
                • SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
                • Size 7KB
                • SHA256 459dd3ec418844fdc08c41572f5dbe15b48ef329ef0f85156cd86bc4dff7a78c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
                • Size 12KB
                • SHA256 79c8bf72957184fcdfde1c5e6a95afedb6d63dccfdc25d7d5911ebe407db6043
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs-1.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs-1.js
                • Size 12KB
                • SHA256 be7722ca87d6c3e6277cacd018cfcb40707d6f14e896a453b377a5589a40f02f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
                • Size 12KB
                • SHA256 e3adc06c0d375f54558c3787b40ed2daa1eb03f432df06d27db704e49f11a427
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
                • Size 6KB
                • SHA256 c0b6169b894bc115b65aad78232d69cebaf8cc81c27b582a45ea7a04a01624a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                prefs.js
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\prefs.js
                • Size 6KB
                • SHA256 0e39a4f1a36efc46244d3be98ce7d311234db3167562a59d913fbc8190860385
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 11KB
                • SHA256 2ff36c45c0c97076466b3d8d97ece9a4a52f131cf9799b2c5ccd235141685d19
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 11KB
                • SHA256 16ac9bb9f20e7ca224874df7b50b1a30ec1449ae6c891ab6240297e79cfba3a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 11KB
                • SHA256 f084e49c05ab1cfc7e817583cb96283c771dc949c888556bb3da5c7558beb6c4
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 20KB
                • SHA256 008e18a885878aff4e43057747902f3f10bb6cb209dcdad4f07e4d99a500a763
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 5KB
                • SHA256 e53ec9f7020e4f6e2dc50e5bb9fbb6b3e0452f0ab4a41e2009e85ba099d5353b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 11KB
                • SHA256 eda628ce85b95b3d49776439f5bf3cc2f8965fbe25e45885e7651b83ca6eaa60
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.baklz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.baklz4
                • Size 11KB
                • SHA256 80f2128709d249c5996be50542dea907e2afcdaaad6ffb4f68192c3d28a69096
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                recovery.jsonlz4
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\sessionstore-backups\recovery.jsonlz4
                • Size 1KB
                • SHA256 181ee0c012964c7ec7e4bd4a7908a187a10f8e0a53ecc6232e4cf9d9a5f22627
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                3870112724rsegmnoittet-es.sqlite
                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kfuxsl7p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                • Size 9.0MB
                • SHA256 faee550fb145e1eba9481ce43139f73c3293a6158f92835f8a4b3846a4b54ec3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Atom.lnk
                • Path C:\Users\Admin\Desktop\Atom.lnk
                • Size 2KB
                • SHA256 56e85c70ab584c4851bf5131509d83f91ed728ca58b3a48c72e56d920563ff92
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/4964-9-0x000000007067A000-0x000000007067B000-memory.dmp
                Download