Analysis

  • max time kernel
    140s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/11/2024, 19:35

General

  • Target

    CloudyBootstrapInstaller.exe

  • Size

    47KB

  • MD5

    9e681e8a6c61f2bd6cde35842bdbe9d4

  • SHA1

    968ccfff20166db5af30011e2d31f4d2ad5c52da

  • SHA256

    f9ca892ce53cc42030042733ae4f131a9e335d342eaa895d6feaf8afd6c7acc1

  • SHA512

    b4a3ac324dec74ac665763019778444f8ce80756ef54d4f7d051b9710772cd2703853a0e434f3214bff85a4231106c2df090f07367ece0cc560bfde46011043f

  • SSDEEP

    768:rVbg7TFzZtlV6E8VlCI0nfxePeNTL1nFdh1B4WkXpuBaV8P9ki+La6JJ7tYFA+VY:rBgwflLFcT17bygg+PuNL1J4jVcl

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\CloudyBootstrapInstaller.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\ProgramData\Cloudy\cloudy.exe
      "C:\ProgramData\Cloudy\cloudy.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=cloudy.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView" --no-default-browser-check --disable-component-extensions-with-background-pages --no-first-run --disable-default-apps --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-popup-blocking --internet-explorer-integration=none --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --mojo-named-platform-channel-pipe=2380.4764.6257787025728361141
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3968
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Crashpad --metrics-dir=C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0x104,0x1bc,0x7ffa95b03cb8,0x7ffa95b03cc8,0x7ffa95b03cd8
          4⤵
            PID:5076
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=gpu-process --field-trial-handle=1804,1387845045166093248,7066098511139719472,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --noerrdialogs --user-data-dir="C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView" --webview-exe-name=cloudy.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:2
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:1344
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1804,1387845045166093248,7066098511139719472,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView" --webview-exe-name=cloudy.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2160 /prefetch:3
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1572
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1804,1387845045166093248,7066098511139719472,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=utility --noerrdialogs --user-data-dir="C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView" --webview-exe-name=cloudy.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=2424 /prefetch:8
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:32
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=renderer --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc" --field-trial-handle=1804,1387845045166093248,7066098511139719472,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --noerrdialogs --user-data-dir="C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView" --webview-exe-name=cloudy.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:3328
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedgewebview2.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1804,1387845045166093248,7066098511139719472,131072 --enable-features=ForwardMemoryPressureEventsToGpuProcess,UseSwapChainsInSoftware --disable-features=FilterAdsOnAbusiveSites,SpareRendererForSitePerProcess,WebPayments,msApplicationGuard,msAutomaticTabFreeze,msBrowserSettingsSupported,msEdgeFaviconService,msEdgeLinkDoctor,msEdgeMGPFrev1,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgeReadingView,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingUI,msEdgeTranslate,msEdgeUseCaptivePortalService,msImplicitSignin,msPasswordBreachDetection,msReadAloud,msRevokeExtensions,msSendClientDataHeader,msSendClientDataHeaderToEdgeServices,msSyncEdgeCollections,msUseLabelingService,msWebAssistHistorySearch --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView" --webview-exe-name=cloudy.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --mojo-platform-channel-handle=4004 /prefetch:8
            4⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3536
    • C:\Windows\System32\CompPkgSrv.exe
      C:\Windows\System32\CompPkgSrv.exe -Embedding
      1⤵
        PID:1932
      • C:\Windows\System32\CompPkgSrv.exe
        C:\Windows\System32\CompPkgSrv.exe -Embedding
        1⤵
          PID:2676

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Cloudy\Intro.mp4

          Filesize

          736KB

          MD5

          67bae02eb1d1c42b167f5ac81f7f6ad3

          SHA1

          4a5eba7f853bc00c3948368f7290cff6f7d8acf9

          SHA256

          e9abcf4ff372e22c900ad18e4cb99b52a5b691eb53573940fb5e23c226ba74c5

          SHA512

          865ab59e1c62658cf980e4b9efc95d526492b8f6d7c73a8a3d287c5f3862875046de8ab31537114fe50ecf2350b496e8a69a21147f8bfc12048b23d4aafde09d

        • C:\ProgramData\Cloudy\Microsoft.Web.WebView2.Core.dll

          Filesize

          575KB

          MD5

          a312715b3b3e7c28be91c9ca11a2e8c8

          SHA1

          efb22e1496de7d5da74c740be51f92c8625efdff

          SHA256

          a5878dec68ba65280d0bb450b1029dad9bb380b9f24cdac4503ee6a919581e56

          SHA512

          eb6308060b151ab3f7272ad9f99ae494627ddfa4be86eee5d615131cf8e228b31d76d9b4f1897564b5c94f76444c28ecf5305525784e38a2510f27f322085271

        • C:\ProgramData\Cloudy\Microsoft.Web.WebView2.Wpf.dll

          Filesize

          80KB

          MD5

          80ffc92e3f11c3f4afb11c618b77c31c

          SHA1

          cfbd6285a741c24e6af5db59cd130644a652e49b

          SHA256

          bdf97ef62b93a0599973ce28aa300b74d0407c51c9f9067a97723366ea0c81d4

          SHA512

          3df9eccf553ee4ecca5c696019935fa2ca72cfb09983366b6806ca5e8407fe6f993bf85919219d35c949d2ef279d3243a5b92bd49c7016bbd3b79fbd73271636

        • C:\ProgramData\Cloudy\Newtonsoft.Json.dll

          Filesize

          695KB

          MD5

          195ffb7167db3219b217c4fd439eedd6

          SHA1

          1e76e6099570ede620b76ed47cf8d03a936d49f8

          SHA256

          e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

          SHA512

          56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

        • C:\ProgramData\Cloudy\ToastNotifications.Messages.dll

          Filesize

          88KB

          MD5

          e64aa8aa12f16c7397d95683206cb70a

          SHA1

          8172b8bc3b027f36ba1182abf26609d7e401e4f8

          SHA256

          556dc81ceda593f828ec08ecf408b92686cf0cf14df4f04da3c9c83f80cce474

          SHA512

          1f3bc239f9cef7ea4baf6fb6524ca6aa71a6dcc3127b7da8b2dcfa46181e2e2a9a1f58ec026b3a49fb1d50157748795ba6b8dd83f81353f481fb50bb3693f743

        • C:\ProgramData\Cloudy\ToastNotifications.dll

          Filesize

          107KB

          MD5

          ce4c69d4ba73105bf8eff333ff8d265b

          SHA1

          28549362058bce91dcad5a13993f4f4b26f17530

          SHA256

          ed1297117c8dba2b3880246721af5b74c6ae16d745bea176adbeefc1ee75f2fb

          SHA512

          adc3c6f4d6a70814eb665039f2ee8387522475ed90017d72a37a0a381bdd3d5dbfd2a5cf26afa01f53d0bc312ca568ebdb7d245cdb21f0808d021a92b450b624

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\base\browser\ui\iconLabel\iconHoverDelegate.js

          Filesize

          368B

          MD5

          dff5cd240217dc0e722c27be242db91d

          SHA1

          244d1e7b3a10bb26e52ad9019e0e20f8bb3a72aa

          SHA256

          151caa77914089aa02273bb851f4b9a198eaab38da7eb9e4bdd7af8075c2dc57

          SHA512

          e6033e28f65f29ec3a7fc2e367bb6dd2909e38e5e5ccd267fe920e82c25de00c3cf5593db022dc1664ec00652882d5093121f2686788ee3eb60d0b2d87fef6d5

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\language\json\_deps\vscode-languageserver-textdocument\lib\esm\main.js

          Filesize

          10KB

          MD5

          722df93c13e5a9e4b3a42c515d6281e3

          SHA1

          e046b8875a0373f38e8135f6500bc9deb9b1cc34

          SHA256

          bb9e7de4f27538b132cd593302a62f8a42f433e1b0e04a1edb4472a97d6ddf46

          SHA512

          6e1db81e7286e7762cce5c281c1ddab227ab374c5c33ff45a5031275592a84fd47547b6ad496f302bbca0bbdc01ed899ff8ed87f22bb8b88973a257e345b70ac

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\language\json\_deps\vscode-languageserver-types\main.js

          Filesize

          66KB

          MD5

          f80215fcc9a89ba7be3bc0b32cacb094

          SHA1

          8449846cc76fc770a31e310882454f5d6beae342

          SHA256

          1adcb7cc0756472bc16ace850f3f5b6d5746ea4af2d75ad0785b967dd07bf9f1

          SHA512

          7187397ff691dfe558c00a8393d4d3d86b7ab8fdbed8b40ecd43c8ba3af40f8ceab0f78d001cc892ea0d5b5a36be4a559715a4385b39a6db1ce473b2883513b0

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\language\json\_deps\vscode-uri\index.js

          Filesize

          11KB

          MD5

          db7069b3b398babf3a2a97e7f7c3aa65

          SHA1

          2208bc3bb4548247d672cbd3368dbb992ce6d312

          SHA256

          15fce1bc78e59f11f36c62e31b6db98d10cf5810fcb8fceeecf9cbdd2ac9742d

          SHA512

          326716687bed34d862a71df1c7259988de21ef78af8829d2253f099988818200477df7e13f97fa78671d426a856feaa651d1c8350f7edac5d59ec9bc13f354d3

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\language\json\fillers\monaco-editor-core.d.ts

          Filesize

          37B

          MD5

          604924c7fd140e65f677cff5c06ea77e

          SHA1

          60adb20bf4cac895df6b31a4da98a4d2267ca3e6

          SHA256

          87b3728d7af0f6c25f9cdbedfbc093f5e46a24371910199a638a1a13e3444668

          SHA512

          34affd619893b93ebfeb0d19daf6c4768b0e3de7d4d8272058cd41608ef9a1f5ceb5951b0b8a7732dd4e3e020d51bda9c9509eed4a3a5705d3a1ad396d610af1

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\language\json\fillers\monaco-editor-core.js

          Filesize

          404B

          MD5

          40fc593844c4ee88ff8e87481824dda0

          SHA1

          c2d8bed92d90e685576812d7c62ac2db28af2185

          SHA256

          a27649c652a7abcefe0b54567eb64f1cdf9be521bab22cfb71718e816b160375

          SHA512

          0457cf90d188e803401555e57a24647e592830ddad9e9e73d64a89889ec6b40eb15d2330ba507c6bad2faceb6c14bb643b4557db1e68896354aa6a19a99ae357

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\language\json\fillers\vscode-nls.js

          Filesize

          1KB

          MD5

          1e2ca4b54776b992ed920a66940bca7a

          SHA1

          86ed5c8360d31c4763c05184fa4e7cc46cfa9354

          SHA256

          539191b86cffb8607fc04d0369756281f63bcb884cbe6ea729a668edf4018059

          SHA512

          fb249812b6587078d8a715d4c684af62db0ed05f6d80afb3374fe1f1e0a0a11b2c2551fcb738f3383b88152f95ca889c7c81543da7575d8d8b161d5c9ffea07b

        • C:\ProgramData\Cloudy\bin\Editor\package\esm\vs\platform\telemetry\common\gdprTypings.js

          Filesize

          12B

          MD5

          5c7f99e3d4eaae821996a487acc6a5e2

          SHA1

          9ff99e6a0a31241fe503c3c76a340bedfe2902b7

          SHA256

          f761c91419d0a89422a0004ef1a92929dd4d2d5e5c16758654d8b0467d1998c6

          SHA512

          9247b46a096ad45b486e4b83bb880a7d4e0da7731e3e64b8ba41513a0632932d3bfcf132b2d20e81e363c2595aa9a38d486111dc6365c0f014c1af25ec0be839

        • C:\ProgramData\Cloudy\bin\Editor\package\min\vs\base\browser\ui\codicons\codicon\codicon.ttf

          Filesize

          63KB

          MD5

          b13daaad214ef227a36fefd95d924380

          SHA1

          95791fc8733a4bae907859b1a46bd1115f90c983

          SHA256

          774c4acc42f27289850537e2b6e9b85f67fde54145f6f41876dc4f65b45a4a20

          SHA512

          ad05613494a490e01504a30e34d7fb5bc2e535d70b5e5d5154a81ad1acaa51c0e368a6fae6aaa0a42faaae63f7e751a98748a7c291056100b7ad687ff6ae687d

        • C:\ProgramData\Cloudy\cloudy.exe

          Filesize

          1.3MB

          MD5

          64e1ff78d96b9b8597dec87a4e30be84

          SHA1

          6fb6b1d8bb88eac9902dbcd927f26f5e9bb024af

          SHA256

          b39b06b0afe0b89f7781a4bddf434d42392b6eb8b1a4dbcf3dbd651b8402be6c

          SHA512

          6bc83260241e4e8aeccda94c8dceddf16f97c9aa1152dcf1f8c6260063b37f2fb3a614ac5aa9c162837dd94e3437857a8135ceda14e1d37d83fb64d9483d0922

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\CrashpadMetrics-active.pma

          Filesize

          16KB

          MD5

          1f2cc5c4d277ef71448e68292d2392fc

          SHA1

          f44b15df723c2e282c7832460f4a53eb93dbfe51

          SHA256

          a49e9cd419b0327e62d2acb9c65165feeeab20bfeb22e1dfa61e1fa3ab14fd77

          SHA512

          2334668f7291e9f3a5060bbd339c6c312271c223ac177f6ba06addf87d4f9943991fbc234707dd2f7e02c9acece3fb3c503df77056e7156ed9c74b96fcea7a93

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Crashpad\settings.dat

          Filesize

          152B

          MD5

          e620a1cc9ad7d19aff40a79f41b9b773

          SHA1

          8a23deef135381956b85f7581612a320d9dc9fea

          SHA256

          359cf4930f7995b33f4aaef3bcf3055c4f18aeb3a95eb57b29a34b0c83f9054f

          SHA512

          daad3ae5e577a3e9bd9fbf22a60a365c1408347a2d7e90f66805edb7264dbaa34a051c14bbbc457e5ea0757f4e818b7d16d65b79af0bf21466c0b20750468e77

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Crashpad\settings.dat

          Filesize

          152B

          MD5

          f075f4d8a30af0cd4dfc1d8d3e602cf9

          SHA1

          0001db9f1a3c7f44d733e1f876da9e4eda978b4d

          SHA256

          bd814e726d34800aefbda027654676df66dc1e455cb57275926dae08f3c8e331

          SHA512

          10db10708e1a7a458716e7382af56aeabae3039636d5de86a33c4e33d94162dc199fe487a79ed41ddd5504f6cfb8a8c7fcfa0f9565b4d88297edaf33dc5a5077

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Crashpad\settings.dat

          Filesize

          152B

          MD5

          4708cbf244e70bbcdc6932c4c71d9d26

          SHA1

          d46b21c67845d64f67005fabaf0652a9dad6d636

          SHA256

          c1b4b977b361571b0943df804b5d22e20cf897b4663103fa27524e95fd870752

          SHA512

          e10817025b3739ac1b0f7697df5bd0c4b242d5d6f995f2af7f748c76cabdf152511a019996c2343cea93790f51a1ab0e21bac3cfb44f82ed00d03296c59d6b38

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Crashpad\throttle_store.dat

          Filesize

          20B

          MD5

          9e4e94633b73f4a7680240a0ffd6cd2c

          SHA1

          e68e02453ce22736169a56fdb59043d33668368f

          SHA256

          41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

          SHA512

          193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\054177ba68736163_0

          Filesize

          254B

          MD5

          a760b822764953a98895ccfd65e4a15b

          SHA1

          4be6ccba2ea36b2f6bc0d08e2574cf3c8b12d4b8

          SHA256

          061a5b416f5c79d2eaecdede0e97de96fecfcac51b3b488d21435157b91de2b5

          SHA512

          11f5cdce00e90ed3e70824cc0c3b6d5790dbb85aa5df8894975991457b6ad40a8153b4523e9fb47a77033e4d88e3aa801b02cd5a92076e27c2ea3b368ce8db5e

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\19a66de6d119ea99_0

          Filesize

          260B

          MD5

          205820db101be787394e60caaaa5ee6e

          SHA1

          73688f88410e657b5f3bba617b4b06167a83a14f

          SHA256

          ac9be2a68fc97b409a65b68fbb53e903ae214e697871276bebe3d103dc3ac235

          SHA512

          9b5e4b753b67ef3fe5abfce846c72789ff9f236a3eac7741057d310dae96c5c0b579b2d1539a95dcf138112eab6ba04408cfa95b93d8c1329df801834778d7fa

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\1b442a3d31831e02_0

          Filesize

          262B

          MD5

          6cec923611483cb77a3c44aa56b6fb37

          SHA1

          d55bf8fc325a2a808a870270c9e7089b9379f63f

          SHA256

          885936d9f42c8e234fff317e76fb7c99a1b7b31f69656f411ebe8d50eb5210ad

          SHA512

          ea5cb58f7364a500f18025f57ee016094446b40614d549145799127ea26a7360abf56d6f31ab384116020cdc3665cc862c0a39f03f97a87fd9f0c55e40897edb

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\2ecb39eb3b78c280_0

          Filesize

          254B

          MD5

          c35ffd49709165e9eba00fef63a064c7

          SHA1

          6823712d975c6ca01a60d402a73af0e9539f32f5

          SHA256

          0fe698ac6b44de819fb479ea0e4f0c3cde5c024be473ef9ccc700c4616f29467

          SHA512

          08ff9841fa497cf94a4c5b8242adc44ad98cb4045c1100f8cefc73a630b3c1e975fd9e5dbd706a788f6aaee367244e256105cec6229fa05572f8a7019f6a67ad

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\319c8298095c1537_0

          Filesize

          858B

          MD5

          cf61f43fcbd09d96295fc5dae0ff0065

          SHA1

          cdd6a4b7dea22f7d9afe66e1bb26fb8f0d227ce1

          SHA256

          21ad6b6ebeda6600ac903f15ba80f63337e98ed67cea5b028232a9ab79942058

          SHA512

          79394b6445373d7a536142775cd831e939351338a6d47355a5a747f44efd6366461ef87d131a9a45d97a5eb2def36481c714ecd0acde22c39715e22a1d1b32bb

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\3b5cc81a6e5144b0_0

          Filesize

          551B

          MD5

          80ea7f16496ead49357f04891c65e5a1

          SHA1

          6475f012aaeb302fc76f7e7a95cec60f06ee8b05

          SHA256

          cf91fe0e501c32cab2cf611310b68d9e5fec439169c3287e324001b25b36f024

          SHA512

          b85db7b88efe837973d1bb5f9e4c263fa388dc1cda53fec79b21bc2ded313e41e7c6594de2a3131c918af4ef9ee89031c05f8255609bc01238bdc0447da9e990

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\3e4f34498e0c5883_0

          Filesize

          21KB

          MD5

          ce0d7dbe86516dab11c740a2d22ed474

          SHA1

          f46b1e0cdcfbf3dd8c47daf1029fc03780d49915

          SHA256

          3259b4af1197ab5a6b68aa93e642fe3c418848fcd03f7428a99262bef2e08166

          SHA512

          198c1ff257be914a9bf224422faf71128149ba2a3c803793a4ba197bbc12b65e36eaa83400b2700fa51bdd482d05da41db3b82a5ae2bbd5e96767162f2e3620b

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\56d17ba9c9181e63_0

          Filesize

          262B

          MD5

          d286c2c355c8109e116110b74e451daa

          SHA1

          1662432df5f1ff20198208009cfb94eb80cfc56c

          SHA256

          5545b733561c0528427f199b3bfef33b161fa840bbffd0729f8b2e38db3cb2c8

          SHA512

          ccc221ae49716c66b118b53f69c5cce7387b26c0751dbb59c8bcc35064ce6f431dc13329260862ba3a711ced2fb13eb59734a01fe174858438cca6b704dc891d

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\750180bbd054c074_0

          Filesize

          222B

          MD5

          921bdf20ef4c79f2e757eacfb65d6b5b

          SHA1

          e98547f43e7c79fdc3fc6de5c48be804fe24cf97

          SHA256

          7e75b8af50a08f3653dfc6d3652c9a0916b1e2f7ef437d410fb419e0c62b7798

          SHA512

          e14f373654b1a2f30264891d7835ac374ad87bfe1442c4f751ae6c6bdfdde623ea0789ba0f0dd14775d8a3e2f793c0cbc4f326a5d844920d183f7212b408bcdf

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\8bc8d1f52efba361_0

          Filesize

          650B

          MD5

          4ea504f362ff29e2ed89985d813d790c

          SHA1

          d06eae04fcf05f07c22534682d316746e63e06bb

          SHA256

          5c88a7d22ef4519c0c6ea6951eddc16c05c477d05381914a64fe04544feca61d

          SHA512

          6a3acfe732bd9686c57f86828c34ba9ae3e3fd3242dbfd98f8ab0f6551025b0a6c3b5582c9c47909193e1d6d0c6a15375b2c730da8a1aa2071f759642664a90c

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\8e7da273e8a2bc38_0

          Filesize

          2KB

          MD5

          286396762753c3921b949a0cc19eaaa9

          SHA1

          e3a67ab87e1f4c3a719b844f8e7ad51e0e7b1d5e

          SHA256

          4b0e970218243e87d97cee336ef7ffd21af918a4952c5dc986fe440580b8349b

          SHA512

          afdf4194de14fedd103679d2e55c30209ebee6f2afafaf8db11287251d66802ca0887ebba96650de0aa78675bdf030fa142352907af21f76ed9e6075f379533e

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\a41eb21f08aac6b0_0

          Filesize

          286B

          MD5

          d22f566120cb06894a1c750c6bd6cc26

          SHA1

          c461f1878dee882df941230351470272aaec3274

          SHA256

          5e4ed0ebd1b5b7f76b737e81aca6ba25cce3b40a2e4172e382ede5e5a193b365

          SHA512

          07fc7517b71da62a08a2f19487637db6872f476f1ea1c1ee50a69fb9d7a4b2034d59b19d677a074f92939a34b56464cee4a2916d42cfce519ec949eb518e68fb

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\b943317210a502aa_0

          Filesize

          261B

          MD5

          b519b9192ddc4864929888fb1d6857c8

          SHA1

          f693b1f7f2a50f438fbb9cc21ab1535fcd43add0

          SHA256

          2f89386700287dee7b64bd22046902a92f476b2dbcfed232364d5dc5f4484958

          SHA512

          2051052f761d82ed3de29ad2aafd8602a088d2e157dc9adc0e9f7d595a79d1bd39468d24bf7850e23fdce213e3c1f1348903e95426dd29011265a8a441771aa7

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\c7368f8b2d2e79b8_0

          Filesize

          285B

          MD5

          b19b10bcfa6632246876584af32dc26e

          SHA1

          bfc64de339c2ee65c8bda6d7f398ead1e961a42b

          SHA256

          81f2aee2a62bb8ad9346fc07c258075f56158a0cf20054f8c7ce648d65793aa0

          SHA512

          e04fb686e598c62e724d1544ad7f13706c1ed9fc20dc9b5eca1d645c7d1a96682a46dcacee7175a6511828da453ee395f68e2f5324ea43b4c5879b91808c8eb1

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\c85ef0a9a668d0be_0

          Filesize

          270B

          MD5

          0cf170777e17646c7cdf4a55a1f8c569

          SHA1

          3f2b25b2b43a0949db7a46a7161405189ee79a05

          SHA256

          5abacbeb912a82e10c56924449e9d340b86bc06fc9837522091bb90b9f5d29cb

          SHA512

          3d1422ee582c4d93716a4f7ea159a5c32b94d389c1ecf62c850216a0282ce2fcdfa1e49d400595853f795b74f11480137704e6ca74380ea85ee1b8fbbebc1dc8

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\c93f0acdf076dbec_0

          Filesize

          258B

          MD5

          98bb1c4758f23972faf1ad55b359cf01

          SHA1

          be6449b517a6f11f567b50086242d3a815e07c5d

          SHA256

          5663e553ca3888bee8cd4facd71c88f653e5ebacb3c14d9f38c572960ebc49da

          SHA512

          4a28aee9dd0942b17bfca05a8e1b1a40f2ab377897671017bd016e8af4c31d27fd4eb3ab8d3ab53fa8bc3767ad114a4826abae705f7f8fbce31c4cf382e274ba

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\cee28bd155cdc641_0

          Filesize

          296B

          MD5

          e14e720634dd5901234545747b34d54d

          SHA1

          64461a0ce7b27ef0d5f01c6e151acec24cb83190

          SHA256

          4b29e465dc4c3e899b45d346d667ecfa546541916bcbd6b28df978d4a16bf465

          SHA512

          15583318b5e374255419f04c1ea9b60832cc978d808674095d1ac9bffe2395ed7320ec001be27f304ef16178c0b5b7accb636baf8efb8e4be9f86a010bc56024

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\d1504aa43725575a_0

          Filesize

          254B

          MD5

          93e7e2ef2bbc7dfa6e894729c81e986d

          SHA1

          357e6ee45a936dbb4577ff966945683ae1e79cab

          SHA256

          27677fa586d7893f20b8ae277c46d784376d8234bda47aee58331d9dcaa5055a

          SHA512

          09183c18e080e482e7a021704797aa45731d667887e877f61c7649c53857d950a381b5db659ab5289c06d22aeab44f0c033c646c2b3df9e627aaf5f4923b1c00

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\d7b454785d667dd9_0

          Filesize

          254B

          MD5

          abb96f366df44e0a757a55f37b647bcd

          SHA1

          ef2e0c1333f575e579437642d76333df8c6790ee

          SHA256

          e16978ce3ba7abdc9039a599c274906adbbf6742af03a5a2bd839fd834cb1d58

          SHA512

          8595a92d25a8a5678234d19554e74818dee8a1ff32737587c8b12502dba7c97f7ae8064fdcd9a72d9114d6a0dc49a00dba94bc21c25c5189fabc1135b59406ec

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\ef27ae3736440c4b_0

          Filesize

          254B

          MD5

          e7e45ee59ea5e05383f9c6df635012db

          SHA1

          e6b0d9c75334d01679e3c47772bdc5619bedcd10

          SHA256

          95aef151453f91162039150f2256b1bf5af7be7c8bf46868f7b23fa51b9dc8c4

          SHA512

          3320544ff32d4e60abed77fad9483c410a0f6cbcffb00777f5c85a2987366ae9371cd974f0c8765ef1ab7516c84ad0214436a6a22252a6f733fe31b9b2f359e8

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\fafa63a771fb4bfe_0

          Filesize

          350B

          MD5

          f2ea45471f875c35af567bf06414512f

          SHA1

          b5625ddbdd7fa3d0dec7abf38f2941a2264db5bb

          SHA256

          795517714c12e0740c0e5631e49ccead9a9078abb0c951830bd4eee9e95f1976

          SHA512

          8945f69fa9264c02187b0c2f18c0cb716217edb9fdedee0ebb5c5876d0ec0313fdc52a52ba60e8b5e56495cb0ea77983773bb88a167cb1cddcb5e5e78b23484a

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\fda372ae7e80f691_0

          Filesize

          274B

          MD5

          534955d205778f74f885405251ac018d

          SHA1

          05e1b254dd07e9e518b9e409c3d6111d7a5e984e

          SHA256

          2ed6811628a4bf10354f42f4495ef2e37fb9907056a202ad5df7650f73085e43

          SHA512

          b8a0c11010ba2cd49e1aa37438f73dc1b716549824e63ef11a341c86bcda15c36b7f348762b1937b0a022f27f7174809e680013445c54a4ee1d97cb96b9460b1

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index

          Filesize

          576B

          MD5

          4f69247a6b3fd8e9dd7d596e644390b7

          SHA1

          c9a84d77b365f0241d848879fb804c2bc164d69a

          SHA256

          d68a51194026796267c521e90011113772ff70256e7b37e7ee69519a0723794b

          SHA512

          dd12a57ba314eee566e38b50a00334d61e7688520c7d2579d35be9c0cee017004cc272eeafae5e37e2552dd28ad0cc8d75044415a85ab2baa410795573bd6a74

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Extension State\CURRENT

          Filesize

          16B

          MD5

          46295cac801e5d4857d09837238a6394

          SHA1

          44e0fa1b517dbf802b18faf0785eeea6ac51594b

          SHA256

          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

          SHA512

          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001

          Filesize

          41B

          MD5

          5af87dfd673ba2115e2fcf5cfdb727ab

          SHA1

          d5b5bbf396dc291274584ef71f444f420b6056f1

          SHA256

          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

          SHA512

          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Favicons

          Filesize

          20KB

          MD5

          babd43551f1b29eb82e221460676126a

          SHA1

          e9bff307613a14b35830893bdb6d1ecc931b425d

          SHA256

          46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb

          SHA512

          5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\GPUCache\data_3

          Filesize

          8KB

          MD5

          41876349cb12d6db992f1309f22df3f0

          SHA1

          5cf26b3420fc0302cd0a71e8d029739b8765be27

          SHA256

          e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

          SHA512

          e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\History

          Filesize

          352KB

          MD5

          c145c8ffe4b3852bdd02f1dca96ca306

          SHA1

          59d19a7c7fadc9159fb8e22ff82c7e3f984d56e9

          SHA256

          26a5094d2e34c467a849f97cd67266c0d80ae43cb8fde8c85b5cf466af1cf6bb

          SHA512

          cccc0445bb1c5b7a55f8b05455cf09104ea0415c43c593b4a268cc0a2526cefd84603d20f10a0a544425c36f6dd7b88e48bf3d757555bc2d984a4c7b9a80c5c5

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Local Storage\leveldb\LOG

          Filesize

          422B

          MD5

          838881df77c8a966bc999e9b07865b6e

          SHA1

          b9b1414f9967155016934db9efafba8ed8e24e17

          SHA256

          2cdc91c3d2f936108980ccaa577993b22307fffbd9bd01ba545907468320eb7b

          SHA512

          c0503277a6d8a65a3d3dff1c10e3ddb7c03b18e56a80bfd66b920738ad5e313a796670457ac40b9c3faabdf1aa4ab961845d4f0a239db824951235d81008eae3

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Local Storage\leveldb\LOG.old

          Filesize

          422B

          MD5

          3a9a67e971813d8a3c0b6c6b2782e38e

          SHA1

          40bb399096bb549e61bb05879876dae18437cb4c

          SHA256

          e7f9c1ef0f901bebec5758f2d9a9ae1aad2ee9f80c0c7c114137a3731c271d1c

          SHA512

          af9176fc35f987b0e3fc563c6bd1c1bc29bb3abd3d9fe2440970dcd48a8bd0d83ad433196cfaafe8b4c4ca7542e47c9ea8742df4655a3c6c37f5cb314008d7e3

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Login Data

          Filesize

          42KB

          MD5

          cf0d378139d518ac262a5cb0979f238d

          SHA1

          94a24d2046879c9b26347909eb02cae09d40fabf

          SHA256

          a5c1d3aad1ea6dfa8484d39b4b6239529889661a0a4d9643175df4d5915c7afa

          SHA512

          d856b2d705188592828b2f277967f269ed46e5154d9e20b955b0e131d8de964b400672d167043be454104429be2bb5f285a3c084cd578aff2ffeb5363099bb4f

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Network Persistent State

          Filesize

          299B

          MD5

          ba925cb2f4158417422355a6661bbf9b

          SHA1

          748c27943511b5e1279cde6e80fb51621bda011c

          SHA256

          fdbd508ff8fb717cec0e3e892cf152836f30660e226e2fae43dfddf25cff1665

          SHA512

          a7536c4dbfa88a89de9259c093722b75de565a94a070635b40787b0c6db6156e608bf8ab9a6f3b3e10e7a9bb48c99a7463ead374f748b5b03069c787b19bd68f

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Network Persistent State~RFe599560.TMP

          Filesize

          59B

          MD5

          2800881c775077e1c4b6e06bf4676de4

          SHA1

          2873631068c8b3b9495638c865915be822442c8b

          SHA256

          226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

          SHA512

          e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Preferences

          Filesize

          11KB

          MD5

          f37c08c605cc017b3ebd0747800e6fcf

          SHA1

          8f5aafb9bbe5e91d614f4ca173ebca6f5d9fcf5b

          SHA256

          b10f2a623f7c255a1d9b96980318ac5d111efce9e765c48a717156f696a3fc13

          SHA512

          bf0b8d425cccc542130ce7b0eb90a4cb3796c309a96c1564aa2224202b2204e33a12e42995b1c4a49e8f91bfc30397c31a272fadd0b2108f9bf634bf66c35bf9

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Preferences

          Filesize

          9KB

          MD5

          6e544a78e19f699cdb39b8a16edb0b61

          SHA1

          07a018c191df38f01f698e3e0507cf640dc59577

          SHA256

          e3f2606799738964417a08111d9bd7c7f9d7e4e8095662abe491e58a4a84956b

          SHA512

          2fc1b4cf7fc2ac490116157c8d6efab94f4b0eb142673556efc786643da02c2ee60b7bea08c263a635bdd89830310ec4b3522d68f29094f420e476d459feba39

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Preferences

          Filesize

          11KB

          MD5

          69b51fff1683efdc108952f158e74d0b

          SHA1

          faeeeec3d4ca9a5b5eccb352eabf686fa9edae79

          SHA256

          09d533445f608b9c6b96f65d6b736b3d9784e8e92086160a6eca80400c9b8b4f

          SHA512

          7414571cbfba213ace04d38a1692aab003b07841e63c17eb82516fcc41f2ea8229f38b673fdb63e1c1c880aa40fb65971f19d585169e97526546897a17b2e626

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Secure Preferences

          Filesize

          6KB

          MD5

          cc5e9811ef9b8a9b353492412793f2b5

          SHA1

          a7d7cdf05c1b2652e397587f07848178f1cfa40c

          SHA256

          4c2cc9f517cdd9e9431d1f8aa363e21458bf0b9d1446212aef3f65744d287b38

          SHA512

          872e00aec5a09a2e831bba8d7a91d4819fa9d15542ac756e46daab1429865994ef06b837598fef0684160ef2a814e7e710b5dad5b3f4141f87099f109b6322ef

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Secure Preferences

          Filesize

          9KB

          MD5

          421dc000988c222678ead8ad99322ec4

          SHA1

          7d21eed9eefa493e90ab213045bca3aa06eeb26a

          SHA256

          921bf034e4430f8157fb31f033581ec415a926a18050ca086fe2a0b30e4434be

          SHA512

          9d1dbe280bd30ddeea7a8b1dd64b3e9067ddd8d77d08cb40ec9cb0869105651da6a6beb585bd2f2d5ce065960b9eff969d11bc96ad602cb4b30f0bddc79d280c

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index

          Filesize

          24B

          MD5

          54cb446f628b2ea4a5bce5769910512e

          SHA1

          c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

          SHA256

          fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

          SHA512

          8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Site Characteristics Database\000003.log

          Filesize

          328B

          MD5

          6c740c50209faf5c5048d44eda5e738e

          SHA1

          e683ab006b8d375c95e6c21cee30c4162b05b775

          SHA256

          9f5430f545b622bce4b7a1c8a7626da8593387295645efda56cffb64dbdbe466

          SHA512

          6ac526d13f74d0b357f9c7c59ed4649997636e3b544a5e6e86a46f98a53f0c30813850f30771c98ea52e5feee59adc93cd7cecd72978134db8d72235ad762404

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG

          Filesize

          438B

          MD5

          5538d092164e465349f103e645149e59

          SHA1

          d49200e8ddad78913000ff4be4fbd1cbe40c46b8

          SHA256

          a4f76cd96f12289acc64479857ac75a1650839990148c61b3825311fdcd47dc7

          SHA512

          97a0a1427a18b22bfef537e6716687b41e6143bb066655231a0e26ff0ec2acbef1fb2bb8f0c1e6b9d81bf84a3a9b88e718f68a61b153d9ec9d6faecd6d0529bc

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Site Characteristics Database\LOG.old

          Filesize

          438B

          MD5

          978a273b2caa4bdd9d0c5bea1695a402

          SHA1

          68af47d7ea0e2c5623b10520ee37160100e48cd2

          SHA256

          c377ae136df7179ab6a4b01d552922b4e7e452935438530b593e2cd2edd8bcb6

          SHA512

          9bbdc0e358ed75614f5d9dabc3e59a967691a3f1f60f33cb2e37383dd6839c15ba4c7b777d88be746a47ecac64fe5e9aa3a78b5accd26bf5f0ffa8a664d136e9

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\000003.log

          Filesize

          46B

          MD5

          90881c9c26f29fca29815a08ba858544

          SHA1

          06fee974987b91d82c2839a4bb12991fa99e1bdd

          SHA256

          a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a

          SHA512

          15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG

          Filesize

          414B

          MD5

          d04886c69ed1fc7127a614eaacebe0e4

          SHA1

          0cb1804d3e5129003943e9a934c0ef3a4707e895

          SHA256

          9ef67e67ea7adb390cedf68e3989b38251874c246b28b0dd9ec48f68c298d5fb

          SHA512

          c2383adc464e776935cad56b34ed0f817875e4d09465e98dc69cbdc72876f2cbf927a58848d7f626873952f77d7a9b3ef4e2e4397878c7a85a27377ea72956fe

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOG.old

          Filesize

          414B

          MD5

          57df5785194ac8ff11488df09936630f

          SHA1

          93102303661f645f30065cc7159173e4e7f10d81

          SHA256

          cc1d3a6f71ca15757cbedc6167458195cbe0ed63127a71f337c86c20e7d73a4b

          SHA512

          d1ee2645250514da6fab9ac0bda757ccf0006f4b177568f4db1e4446a663e0ff7652bca04b69c2cc0018b472f905dd9b8e41f2fd3923fa7642b39e0529f9832e

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Visited Links

          Filesize

          128KB

          MD5

          2d6333c4851699e93c37da4b669034c7

          SHA1

          39dacba376272bdd25ebc879ea0dd4d4e6eb4e67

          SHA256

          c207145a74b75f522912f90555ab62663a12caa81a686c56d6496c8898c44988

          SHA512

          b395dd1c372cee93164ea14b40099a35cf098e6a34d66b0e92ce3ee5f31e9d82480973ce29f0a44a88c0d2a9792c5aa4415ae79673ffbd3f2f081bfa216bf4f6

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\Web Data

          Filesize

          224KB

          MD5

          49c38cebbc8176b10d722423eeda22bd

          SHA1

          6cfee7053220ff11f4623add2877695b74906628

          SHA256

          19f3ae2ca84b1da1d7e6f70eef587eeb0f73d3a4b3b8fb5fe828999505221776

          SHA512

          67478dea68a98213c7a3e927be62028239d5375497b0a8b5fe1f524c409e0a69c2cda6c9c204257822e43434882095fc683c0b92c885b2af68c0af76a9c314af

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Default\data_reduction_proxy_leveldb\CURRENT

          Filesize

          16B

          MD5

          206702161f94c5cd39fadd03f4014d98

          SHA1

          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

          SHA256

          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

          SHA512

          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\GraphiteDawnCache\data_0

          Filesize

          8KB

          MD5

          cf89d16bb9107c631daabf0c0ee58efb

          SHA1

          3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

          SHA256

          d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

          SHA512

          8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\GraphiteDawnCache\data_1

          Filesize

          264KB

          MD5

          36596b5a43ba31f6f29b00f39e62b85e

          SHA1

          4e0b4485841b687e4bb09183573083fc04a201e6

          SHA256

          06df8bab03e3de10af99968d3103c6fc1c12a5093c056e20be9a626e8847a31c

          SHA512

          6a38844bbf448e6322bce05dc1316096613128ed6f0437d8716cb5c95220b6abb86defe5b08eb1e34921b4925a58da536dcb51bbad932ca69d0cac573154553f

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\GraphiteDawnCache\data_2

          Filesize

          8KB

          MD5

          0962291d6d367570bee5454721c17e11

          SHA1

          59d10a893ef321a706a9255176761366115bedcb

          SHA256

          ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

          SHA512

          f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Last Version

          Filesize

          11B

          MD5

          b29bcf9cd0e55f93000b4bb265a9810b

          SHA1

          e662b8c98bd5eced29495dbe2a8f1930e3f714b8

          SHA256

          f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

          SHA512

          e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Local State

          Filesize

          18KB

          MD5

          6a66314cd5bca68319f4f6997529f720

          SHA1

          3e1efd2463f86cec8566d1b0c5bef6350217fc45

          SHA256

          4ccff946b69462f0437acf8b5819fa8347c6e633ade1b2eaa7ea247b2a001139

          SHA512

          a8ccabbb39e0ef3a2e31345f870e19a455d8b0f42a2b38d27136e42929e3f9af11e3cc9986c2c6bedafb4e243cb4dca9b7916cf018d206cbd3fab0a9f40eed44

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Local State

          Filesize

          19KB

          MD5

          88bfec0ca61c6b9f93ed7e32321a9ffb

          SHA1

          1fe8d109ba884ad5659d201516284a01ff0e46c6

          SHA256

          8dbb2313cdcd9dd76afc78b4e810d2fa8166436fe8e604b9e87b8b7230a58a36

          SHA512

          d2be3cebe3e37fba172064bd857db868efd170fde1f8ea7d665eb187f65d193adf2830d0d563c864ded04d6e03e15a57314ee4386be14218b4943ceda6569abe

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Local State

          Filesize

          23KB

          MD5

          668b6dcb7ecb4e221130f7237c29e468

          SHA1

          3a08a0876c63071ab2c401e9ceb71e666d8c86b7

          SHA256

          a0a9d302ab3fd02b930bff13b382c234a8ef250a60b5d476bece57217aa633ba

          SHA512

          9e506831faaea5c0ed5105a0d9df0013da94a0c8f326549676069479f84cb52908ea17574df62df0d679cacb10c3ee308f123b575953ad43a3abe0a1dc77600d

        • C:\ProgramData\Cloudy\cloudy.exe.WebView2\EBWebView\Subresource Filter\Indexed Rules\28\scoped_dir3968_1503236767\LICENSE

          Filesize

          24KB

          MD5

          aad9405766b20014ab3beb08b99536de

          SHA1

          486a379bdfeecdc99ed3f4617f35ae65babe9d47

          SHA256

          ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d

          SHA512

          bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852

        • C:\ProgramData\Cloudy\cloudy.exe.config

          Filesize

          232B

          MD5

          0a8651cf43271223a87cebe950416dd2

          SHA1

          e92dda5bdf81b4e322c80085a72c56bfd2a30807

          SHA256

          d1ad96ba613056a0eee4f363debaf67a629751a480e97faca225d876f0293580

          SHA512

          571e0d21fb1f65d3bf6b5186e07835c1517abf80842ef5ae9db2e3b366b34fee944bc7a80a00a17fe72a175db0d2fe2e6b6607df26ba73a42e3669c05ac5d8d4

        • C:\ProgramData\Cloudy\runtimes\win-x64\native\WebView2Loader.dll

          Filesize

          161KB

          MD5

          61f430f292f85b18b57f06ea6d3d8b82

          SHA1

          03e31a690fa32364fea5ce73498f234adc544cd0

          SHA256

          9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e

          SHA512

          73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb

        • C:\ProgramData\Cloudy\workspace\.tests\isfile.txt

          Filesize

          7B

          MD5

          260ca9dd8a4577fc00b7bd5810298076

          SHA1

          53a5687cb26dc41f2ab4033e97e13adefd3740d6

          SHA256

          aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27

          SHA512

          51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7

        • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

          Filesize

          896KB

          MD5

          2972fba52e9639a8b086463c9e6b1b6c

          SHA1

          a66872378ee54fd614de04e6b955f62a9a11adb0

          SHA256

          63c2dcaa64451ead9977ed9d3157a04ca9a80c7d5fe130856b810ac3a5064838

          SHA512

          b3b78074691eccd9f057851986acf07112d0a15f6a2cca4ed556932253c334bfb5c7884c1cc3883c9519f02a15ceee636429a0f27f1a92c1bc1ef258f701ed11

        • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

          Filesize

          9KB

          MD5

          7050d5ae8acfbe560fa11073fef8185d

          SHA1

          5bc38e77ff06785fe0aec5a345c4ccd15752560e

          SHA256

          cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

          SHA512

          a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

        • memory/1344-3172-0x00007FFABEAE0000-0x00007FFABEAE1000-memory.dmp

          Filesize

          4KB

        • memory/1344-3278-0x000001DB3BAC0000-0x000001DB3BBAA000-memory.dmp

          Filesize

          936KB

        • memory/2380-3125-0x0000023FA3E30000-0x0000023FA3E68000-memory.dmp

          Filesize

          224KB

        • memory/2380-3115-0x0000023FA3980000-0x0000023FA3A14000-memory.dmp

          Filesize

          592KB

        • memory/2380-3109-0x00007FFA9E890000-0x00007FFA9F352000-memory.dmp

          Filesize

          10.8MB

        • memory/2380-3116-0x00007FFA9E890000-0x00007FFA9F352000-memory.dmp

          Filesize

          10.8MB

        • memory/2380-3106-0x0000023F89030000-0x0000023F89186000-memory.dmp

          Filesize

          1.3MB

        • memory/2380-3111-0x0000023FA3890000-0x0000023FA38B2000-memory.dmp

          Filesize

          136KB

        • memory/2380-3485-0x00007FFA9E890000-0x00007FFA9F352000-memory.dmp

          Filesize

          10.8MB

        • memory/2380-3123-0x0000023FA3BF0000-0x0000023FA3BF8000-memory.dmp

          Filesize

          32KB

        • memory/2380-3137-0x00007FFA9E890000-0x00007FFA9F352000-memory.dmp

          Filesize

          10.8MB

        • memory/2380-3118-0x0000023FA3EF0000-0x0000023FA3FA2000-memory.dmp

          Filesize

          712KB

        • memory/2380-3133-0x0000023FA3950000-0x0000023FA395E000-memory.dmp

          Filesize

          56KB

        • memory/2380-3156-0x0000023FAB870000-0x0000023FAB892000-memory.dmp

          Filesize

          136KB

        • memory/2380-3108-0x0000023F89630000-0x0000023F8964C000-memory.dmp

          Filesize

          112KB

        • memory/2380-3136-0x00007FFA9E893000-0x00007FFA9E895000-memory.dmp

          Filesize

          8KB

        • memory/2380-3155-0x00007FFA9E890000-0x00007FFA9F352000-memory.dmp

          Filesize

          10.8MB

        • memory/2380-3105-0x00007FFA9E893000-0x00007FFA9E895000-memory.dmp

          Filesize

          8KB

        • memory/2380-3113-0x0000023FA38C0000-0x0000023FA38D8000-memory.dmp

          Filesize

          96KB

        • memory/2380-3157-0x0000023FABBC0000-0x0000023FABD48000-memory.dmp

          Filesize

          1.5MB

        • memory/2740-3135-0x0000000075230000-0x00000000759E1000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-1-0x0000000000760000-0x0000000000772000-memory.dmp

          Filesize

          72KB

        • memory/2740-0-0x000000007523E000-0x000000007523F000-memory.dmp

          Filesize

          4KB

        • memory/2740-2-0x0000000075230000-0x00000000759E1000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-3-0x000000007523E000-0x000000007523F000-memory.dmp

          Filesize

          4KB

        • memory/2740-4-0x0000000075230000-0x00000000759E1000-memory.dmp

          Filesize

          7.7MB

        • memory/2740-6-0x0000000005610000-0x000000000561A000-memory.dmp

          Filesize

          40KB

        • memory/2740-7-0x0000000005640000-0x0000000005652000-memory.dmp

          Filesize

          72KB