Overview

overview

8

Static

static

3

StormyExecutor.exe

windows10-ltsc_2021-x64

1

StormyExecutor.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    1050s
  • max time network
    1023s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/07/2026, 19:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    StormyExecutor.exe
  • Size 6.9MB
  • Sample260703-xrfvqaey4s
  • SHA256 44e67c9dd612f003f07474796f367723f2967b2d4e529a112833d3e8581fafe3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 14 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Start PowerShell.

    execution
  • ConfuserEx .NET packer 5 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 26 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\StormyExecutor.exe
    "C:\Users\Admin\AppData\Local\Temp\StormyExecutor.exe"
    1⤵
      PID:1292
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:6024
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9e2a6c728,0x7ff9e2a6c734,0x7ff9e2a6c740
        2⤵
          PID:1544
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,8524464519914325597,12308536932561773245,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2148 /prefetch:11
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:4824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,8170356873386299588,12598431341858698822,262144 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:2
          2⤵
            PID:3428
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,18245038365323664912,14456642993268565104,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:13
            2⤵
              PID:4464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,11249023462802011582,7025045104311129538,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:2556
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3252,i,6736539741026294007,6717493259684150747,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3384 /prefetch:1
                2⤵
                  PID:5004
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,2729025465153075191,15613759338388201396,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4292 /prefetch:9
                  2⤵
                    PID:2484
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4720,i,17196641034722389401,14064168515167294004,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4708 /prefetch:1
                    2⤵
                      PID:5468
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4924,i,17905003560922368081,15804407928907701887,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:14
                      2⤵
                        PID:5972
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4760,i,9602680268719133892,17740463710754611749,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5052 /prefetch:14
                        2⤵
                          PID:3128
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,7423560845148967178,11777274959170005919,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:14
                          2⤵
                            PID:3876
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5600,i,13240557291876693498,346471132774322942,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:1
                            2⤵
                              PID:3864
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3644,i,3339604319691094871,7468422191361133012,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3532 /prefetch:1
                              2⤵
                                PID:4880
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5524,i,12414691055265573337,9856297145357918942,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:1
                                2⤵
                                  PID:4684
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5868,i,15324886115563187814,17637192717320665168,2097152 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5532 /prefetch:1
                                  2⤵
                                    PID:5792
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,18148389812837596175,9242734997133947684,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:14
                                    2⤵
                                      PID:4740
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,2635146264352986206,8026751598119547172,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:14
                                      2⤵
                                        PID:3324
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,17958453932108291529,3108448018154963673,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:14
                                        2⤵
                                          PID:5072
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,2329343657817274509,3729192970299528935,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:14
                                          2⤵
                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                          • NTFS ADS
                                          PID:2820
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6008,i,9631401923498637546,11489568683577227777,262144 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5528 /prefetch:10
                                          2⤵
                                            PID:6816
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5692,i,6451360953632291381,2026916857887707035,524288 --field-trial-handle=2120,i,12524477234555264054,13723875230848114491,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6024 /prefetch:14
                                            2⤵
                                              PID:3396
                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                            1⤵
                                              PID:3176
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                              1⤵
                                                PID:5584
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:5588
                                                • C:\Users\Admin\Downloads\StormyV3Bootrapper.exe
                                                  "C:\Users\Admin\Downloads\StormyV3Bootrapper.exe"
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Enumerates system info in registry
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5388
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command " cd 'C:\ProgramData\StormyV3\StormyExtracted\BestStormy' $cert = New-SelfSignedCertificate -Subject 'Stormy Development' -CertStoreLocation 'Cert:\CurrentUser\My' -HashAlgorithm SHA256 -Type CodeSigning $pwd = ConvertTo-SecureString -String 'stormy' -Force -AsPlainText Export-PfxCertificate -cert $cert -FilePath 'StormyExecutor.pfx' -Password $pwd "
                                                    2⤵
                                                    • Badlisted process makes network request
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2148
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command " $cert = Get-ChildItem -Path Cert:\CurrentUser\My | Where-Object { $_.Subject -match 'Stormy Development' } if ($cert) { Remove-Item -Path $cert.PSPath -Force Write-Host 'Certificate deleted successfully.' } else { Write-Host 'No matching certificate found.' } "
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1772
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command " Start-Process 'certutil.exe' -ArgumentList '-f', '-user', '-p', 'stormy', '-importpfx', 'C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.pfx' -Wait -NoNewWindow "
                                                    2⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5616
                                                    • C:\Windows\system32\certutil.exe
                                                      "C:\Windows\system32\certutil.exe" -f -user -p stormy -importpfx C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.pfx
                                                      3⤵
                                                        PID:3356
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c "cd /d C:\ProgramData\StormyV3\StormyExtracted\BestStormy && signtool.exe sign /f StormyExecutor.pfx /fd SHA256 /p stormy StormyExecutor.exe && signtool.exe timestamp -t http://timestamp.digicert.com StormyExecutor.exe"
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4388
                                                      • C:\ProgramData\StormyV3\StormyExtracted\BestStormy\signtool.exe
                                                        signtool.exe sign /f StormyExecutor.pfx /fd SHA256 /p stormy StormyExecutor.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies system certificate store
                                                        PID:3212
                                                      • C:\ProgramData\StormyV3\StormyExtracted\BestStormy\signtool.exe
                                                        signtool.exe timestamp -t http://timestamp.digicert.com StormyExecutor.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4620
                                                    • C:\ProgramData\StormyV3\StormyExtracted\BestStormy\signtool.exe
                                                      "C:\ProgramData\StormyV3\StormyExtracted\BestStormy\signtool.exe" verify /pa "C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies system certificate store
                                                      PID:1392
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CreateStormyShortcut.ps1"
                                                      2⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:2776
                                                      • C:\Windows\explorer.exe
                                                        "C:\Windows\explorer.exe"
                                                        3⤵
                                                        • Modifies registry class
                                                        PID:4228
                                                    • C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe
                                                      "C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks whether UAC is enabled
                                                      • Enumerates system info in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5696
                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5696.1692.17291077747301343602
                                                        3⤵
                                                        • Drops file in Windows directory
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4328
                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff9ceccb078,0x7ff9ceccb084,0x7ff9ceccb090
                                                          4⤵
                                                            PID:3676
                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,13846244989061489146,8813220349441233580,262144 --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
                                                            4⤵
                                                              PID:2348
                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,13846244989061489146,8813220349441233580,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
                                                              4⤵
                                                                PID:4704
                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2272,i,13846244989061489146,8813220349441233580,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:13
                                                                4⤵
                                                                  PID:4968
                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3716,i,13846244989061489146,8813220349441233580,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
                                                                  4⤵
                                                                    PID:5552
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/invite/xvScJNEnh3
                                                                  3⤵
                                                                  • Enumerates system info in registry
                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5396
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x320,0x7ff9c4ecc188,0x7ff9c4ecc194,0x7ff9c4ecc1a0
                                                                    4⤵
                                                                      PID:4492
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,11329735485536646036,318780988901079373,524288 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
                                                                      4⤵
                                                                      • System Time Discovery
                                                                      PID:3244
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11520317218618438300,16159292735121317964,262144 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
                                                                      4⤵
                                                                        PID:4404
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,1277448165615045145,4721312414623469090,524288 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
                                                                        4⤵
                                                                          PID:4512
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,16633758853531135517,14865537799891564938,2097152 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
                                                                          4⤵
                                                                            PID:5176
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15071823389890951274,3619871144804602954,2097152 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
                                                                            4⤵
                                                                              PID:5528
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4904,i,11700954896869077316,4381692427849624035,2097152 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
                                                                              4⤵
                                                                                PID:5560
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,10552859430986764510,6818204398338940995,524288 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:14
                                                                                4⤵
                                                                                • Modifies registry class
                                                                                PID:4776
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,8105406832656536663,2624215331938322595,524288 --field-trial-handle=2156,i,4801842237288724517,12493396594489276283,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:12
                                                                                4⤵
                                                                                  PID:4356
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                  4⤵
                                                                                  • Drops file in Windows directory
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Modifies registry class
                                                                                  PID:3888
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ff9c4ecc188,0x7ff9c4ecc194,0x7ff9c4ecc1a0
                                                                                    5⤵
                                                                                      PID:6472
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1700,i,476924803308739801,5904247800636745561,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
                                                                                      5⤵
                                                                                      • System Time Discovery
                                                                                      PID:6512
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,2703079104743364225,18019024369261258478,262144 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
                                                                                      5⤵
                                                                                        PID:6520
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,7477556629731131530,9298232560093684607,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:13
                                                                                        5⤵
                                                                                          PID:6548
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15392283171838002635,5167390642364056664,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
                                                                                          5⤵
                                                                                            PID:6900
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15392283171838002635,5167390642364056664,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
                                                                                            5⤵
                                                                                              PID:6944
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,8018627804927221250,8503069439795881401,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
                                                                                              5⤵
                                                                                                PID:3524
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,11130618286849646419,1394485696815016436,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
                                                                                                5⤵
                                                                                                  PID:6240
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10275109584137896024,9597627935952437302,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
                                                                                                  5⤵
                                                                                                    PID:2684
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2832,i,10153921172961763725,12610931330352636207,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
                                                                                                    5⤵
                                                                                                      PID:5472
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,6890416832301185693,9622913980330460512,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
                                                                                                      5⤵
                                                                                                        PID:352
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10789232278784227302,1689577781686134636,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
                                                                                                        5⤵
                                                                                                          PID:3664
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,12684786714801052230,11294943447583791318,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
                                                                                                          5⤵
                                                                                                            PID:4776
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,16758527251795131129,14634610770975986534,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:14
                                                                                                            5⤵
                                                                                                              PID:2012
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5100,i,16690939771885102793,3031331385023326630,262144 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:10
                                                                                                              5⤵
                                                                                                                PID:4516
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,3913922022089675767,1175028936126416013,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:14
                                                                                                                5⤵
                                                                                                                  PID:6300
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,8117602266628322442,7276227118091927146,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:14
                                                                                                                  5⤵
                                                                                                                    PID:6464
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,8706739682285392831,3409730556731979531,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
                                                                                                                    5⤵
                                                                                                                      PID:1676
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,15067631204946965167,4816843759703123950,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
                                                                                                                      5⤵
                                                                                                                        PID:5804
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4088,i,1451018735664036138,3488086789565945906,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14
                                                                                                                        5⤵
                                                                                                                          PID:1684
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,5319967464546357327,7324498073210368850,524288 --field-trial-handle=2004,i,6571514484445567333,12177577663889078487,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
                                                                                                                          5⤵
                                                                                                                            PID:788
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                                                    • Enumerates connected drives
                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:5964
                                                                                                                    • C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe
                                                                                                                      "C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe"
                                                                                                                      2⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Checks whether UAC is enabled
                                                                                                                      • Enumerates system info in registry
                                                                                                                      PID:5100
                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5100.2516.12653468892049226620
                                                                                                                        3⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Enumerates system info in registry
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                        PID:6068
                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x19c,0x7ff9ceccb078,0x7ff9ceccb084,0x7ff9ceccb090
                                                                                                                          4⤵
                                                                                                                            PID:780
                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1780,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:2
                                                                                                                            4⤵
                                                                                                                              PID:5176
                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1812,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:11
                                                                                                                              4⤵
                                                                                                                                PID:6424
                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1784,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:13
                                                                                                                                4⤵
                                                                                                                                  PID:6608
                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3504,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
                                                                                                                                  4⤵
                                                                                                                                    PID:6908
                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4776,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
                                                                                                                                    4⤵
                                                                                                                                      PID:2236
                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4072,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
                                                                                                                                      4⤵
                                                                                                                                        PID:7068
                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4980,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
                                                                                                                                        4⤵
                                                                                                                                          PID:4064
                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4780,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
                                                                                                                                          4⤵
                                                                                                                                            PID:6700
                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4664,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:10
                                                                                                                                            4⤵
                                                                                                                                              PID:4596
                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4392,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
                                                                                                                                              4⤵
                                                                                                                                                PID:1728
                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4960,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
                                                                                                                                                4⤵
                                                                                                                                                  PID:3168
                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4772,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6208
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView" --webview-exe-name=StormyExecutor.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2572,i,13583687091293629288,4742719360963193187,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1288
                                                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                                                C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:5208
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:3156
                                                                                                                                                • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                  "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                  1⤵
                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                  • Modifies registry class
                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                  PID:3904
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:5324
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:6584
                                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                      1⤵
                                                                                                                                                        PID:4184

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                            1
                                                                                                                                                            T1059

                                                                                                                                                            PowerShell

                                                                                                                                                            1
                                                                                                                                                            T1059.001

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Active Setup

                                                                                                                                                            1
                                                                                                                                                            T1547.014

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            1
                                                                                                                                                            T1547

                                                                                                                                                            Active Setup

                                                                                                                                                            1
                                                                                                                                                            T1547.014

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Indicator Removal

                                                                                                                                                            1
                                                                                                                                                            T1070

                                                                                                                                                            File Deletion

                                                                                                                                                            1
                                                                                                                                                            T1070.004

                                                                                                                                                            Modify Registry

                                                                                                                                                            3
                                                                                                                                                            T1112

                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                            2
                                                                                                                                                            T1553

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1553.004

                                                                                                                                                            SIP and Trust Provider Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1553.003

                                                                                                                                                            Credential Access

                                                                                                                                                            Discovery

                                                                                                                                                            Browser Information Discovery

                                                                                                                                                            1
                                                                                                                                                            T1217

                                                                                                                                                            Network Share Discovery

                                                                                                                                                            1
                                                                                                                                                            T1135

                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                            2
                                                                                                                                                            T1120

                                                                                                                                                            Query Registry

                                                                                                                                                            4
                                                                                                                                                            T1012

                                                                                                                                                            System Information Discovery

                                                                                                                                                            5
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            System Time Discovery

                                                                                                                                                            1
                                                                                                                                                            T1124

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Command and Control

                                                                                                                                                            Web Service

                                                                                                                                                            1
                                                                                                                                                            T1102

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            isfile.txt
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\.tests\isfile.txt
                                                                                                                                                            • Size 7B
                                                                                                                                                            • SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Guna.UI2.dll
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\Guna.UI2.dll
                                                                                                                                                            • Size 2.1MB
                                                                                                                                                            • SHA256 9ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.Web.WebView2.Core.dll
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\Microsoft.Web.WebView2.Core.dll
                                                                                                                                                            • Size 589KB
                                                                                                                                                            • SHA256 cb8c852fcc4ef55d630b64d171dc11538bb25258041ed22cf31735982a2e09e3
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.Web.WebView2.WinForms.dll
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\Microsoft.Web.WebView2.WinForms.dll
                                                                                                                                                            • Size 38KB
                                                                                                                                                            • SHA256 e62056bee28ab094071144b47371009a6fbc162f9aea184719f2e86ed515f7f8
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            QuorumAPI.dll
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\QuorumAPI.dll
                                                                                                                                                            • Size 39KB
                                                                                                                                                            • SHA256 a764af49371510bcfc1d8360fd90e7234f6b651f97bd50527c8741529611a903
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            shortcut.ico
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\Resources\shortcut.ico
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 e1a61180c4935bc4c68838e691dc1a8018197cb453b0ab75649280e421cc0dd2
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StormyExecutor.exe
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe
                                                                                                                                                            • Size 4.7MB
                                                                                                                                                            • SHA256 bd6350ac5ed297cd86bb6eb6d6e320b8a3bcff980f71fe54649e01c315de81b2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StormyExecutor.exe
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe
                                                                                                                                                            • Size 4.7MB
                                                                                                                                                            • SHA256 8a32038945f2a88e5fbc044db293596f6dcc30d00f081c3879b1c8e822006101
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            931856a1-b237-417a-8c04-dacd93539105.tmp
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\931856a1-b237-417a-8c04-dacd93539105.tmp
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 22ac040bed888e93aa98a255fc4baf182d63c5c4aae596e6090294244493319a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            protocols.json
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            crl-set
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                            • Size 22KB
                                                                                                                                                            • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 924c7774585cb80f0bf82aa3b7b09d0dc945684e99534404d3f99a99bfe58bcc
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 6b554dde2849aa02bc246bafdfde5de0ea002cbbdef62f401505699f325f74f2
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 6587e1ad32395789ceaf13ad3fdf9cc91ca88b4192f7926449f9ea43796866d1
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 ecbea330c322e828e65ab375677f640767f2dbc22b8f55e80f2a65e40f95a1e1
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            throttle_store.dat
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                            • Size 20B
                                                                                                                                                            • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            data_0
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_0
                                                                                                                                                            • Size 44KB
                                                                                                                                                            • SHA256 1e45d664278c0a0c9fc46d05d68ad3e4a4a4e54fff796449ccc8f9d21a9d76d7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            CURRENT
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Extension State\CURRENT
                                                                                                                                                            • Size 16B
                                                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            MANIFEST-000001
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001
                                                                                                                                                            • Size 41B
                                                                                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            data_0
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\GPUCache\data_0
                                                                                                                                                            • Size 8KB
                                                                                                                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            data_1
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\GPUCache\data_1
                                                                                                                                                            • Size 264KB
                                                                                                                                                            • SHA256 13720abd4364daf28f7a7543229906fe03302a3066fb2666387d0aa71eb716cc
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            data_2
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\GPUCache\data_2
                                                                                                                                                            • Size 8KB
                                                                                                                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            data_3
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\GPUCache\data_3
                                                                                                                                                            • Size 8KB
                                                                                                                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                            • Size 257B
                                                                                                                                                            • SHA256 2fd361034a704295c2b5f02142707fe11cf05ed01b2c75f08270af4bab88d03a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            TransportSecurity
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                            • Size 356B
                                                                                                                                                            • SHA256 afc269f9572910d79c494d22ded76f918d7bafb68a705d8ed359407f9458197b
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            TransportSecurity
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                            • Size 356B
                                                                                                                                                            • SHA256 d669f7b94a26c5053fc96ed9c717eacf33089c6a7fae3726f5e0f2054731d6df
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            f277cbd8-b9c9-427e-9623-745395ad3e69.tmp
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Network\f277cbd8-b9c9-427e-9623-745395ad3e69.tmp
                                                                                                                                                            • Size 40B
                                                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Preferences
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 daeb1d7fa6d5aaced0c7a952ae156cd4794bffec89ddc3f9e5cec186da733fb8
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Preferences
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 31ea2cf8474026486054150ad21824c6e27b8e0e9c366c25aa77c5629fb81acf
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Safe Browsing Cookies
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Secure Preferences
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Secure Preferences
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 8388b1659c07c82717639b3c6033a0e7950a0400a6d3380c886bdb4fbc252f23
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Secure Preferences
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Secure Preferences
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 a7da5e026a9d6abca54226f4d125175bd1d78e51cb83c646da43336f67cff885
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            index
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index
                                                                                                                                                            • Size 24B
                                                                                                                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Last Version
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Last Version
                                                                                                                                                            • Size 14B
                                                                                                                                                            • SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Local State
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 727e007e78f3b17453285b883000a09fe118113a17cab3876020b249e86e1730
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Local State
                                                                                                                                                            • Size 21KB
                                                                                                                                                            • SHA256 7b0ac033a9632789c8463585f151bed2153aafb4ef0db8aea15e699b4d4e2e75
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Local State
                                                                                                                                                            • Size 17KB
                                                                                                                                                            • SHA256 d07d3c10319fdb68c84010028db50165e9af1b4f351888ecb06f760d56a80934
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Local State
                                                                                                                                                            • Size 21KB
                                                                                                                                                            • SHA256 d189e6932c4e699eeb674ef424eab27198b159a0af12a489a537492b7174fb20
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Local State
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 e1caf2ff8bbf57dad48473746baf4c80dacd10ba34b5c45062b2cf51eb20f3b7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ct_config.pb
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
                                                                                                                                                            • Size 16KB
                                                                                                                                                            • SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            kp_pinslist.pb
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
                                                                                                                                                            • Size 10KB
                                                                                                                                                            • SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            data_1
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\ShaderCache\data_1
                                                                                                                                                            • Size 264KB
                                                                                                                                                            • SHA256 e5b606a7e82d3044e079ef2d97b9c4718ab8c7968e61b1288892ecec8f77b447
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            index
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\ShaderCache\index
                                                                                                                                                            • Size 256KB
                                                                                                                                                            • SHA256 2610ffde3d539a19f1174f8503f5c36fffa6cc5a4de5e8add5fbe8d547bcca11
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Filtering Rules
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                            • Size 2.1MB
                                                                                                                                                            • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            adblock_snippet.js
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\adblock_snippet.js
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Advertising
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Advertising
                                                                                                                                                            • Size 19KB
                                                                                                                                                            • SHA256 5989ccf9a58e4ffd47c2422bd8dfcb3ea4e1d412fbdec2291385a9955af9eace
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Analytics
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Analytics
                                                                                                                                                            • Size 4KB
                                                                                                                                                            • SHA256 163a5318312b814104d244a4b37b676a02f827068820aa60fc069e6346cb2b75
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            CompatExceptions
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\CompatExceptions
                                                                                                                                                            • Size 689B
                                                                                                                                                            • SHA256 5b462316a51c918d0bae95959bf827cb9c72bbd84ffb0e43b750aa91fbf3ba53
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Content
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Content
                                                                                                                                                            • Size 4KB
                                                                                                                                                            • SHA256 7869993fcb93b302598643be96c6ab94c4f3be47c9fc344959773c754291376e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Cryptomining
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Cryptomining
                                                                                                                                                            • Size 668B
                                                                                                                                                            • SHA256 1e92781e88ee786bf6d1d5cb71d467a92fe7f281f2d1e548524bf119d7ddc700
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Entities
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Entities
                                                                                                                                                            • Size 68KB
                                                                                                                                                            • SHA256 f6e93c83d9e3cfdff064535647cee76fc85aa1c86fd22a93dcf3d2c377346d94
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Fingerprinting
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Fingerprinting
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 c7d2b05ff6e790af78b0f1f341219fdb554dc5e14fbf3e3981819fccdd1ddfed
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LICENSE
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\LICENSE
                                                                                                                                                            • Size 34KB
                                                                                                                                                            • SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Other
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Other
                                                                                                                                                            • Size 34B
                                                                                                                                                            • SHA256 2b4a47b82cbe70e34407c7df126a24007aff8b45d5716db384d27cc1f3b30707
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Social
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\Social
                                                                                                                                                            • Size 754B
                                                                                                                                                            • SHA256 4955c3e7f56641a4ae0ce9c79b4ceee4b21733b0f6dedc980bf8d822a792eba2
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            TransparentAdvertisers
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Mu\TransparentAdvertisers
                                                                                                                                                            • Size 105B
                                                                                                                                                            • SHA256 d2cd0bef5f45daf490c53e705d6f67dfe12390c72a00efa6f5117432bd8edb8c
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Advertising
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Advertising
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 868f3ed3f86f1e82a5041f0a7b382bdd720e411531df2dc680da34eb60580b75
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Analytics
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Analytics
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 33d2b069ea874c12ec96242ca7eb539c1086d38ac6c2e4858c0efcd74fc632e5
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Content
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Content
                                                                                                                                                            • Size 5KB
                                                                                                                                                            • SHA256 d99df5936c57a50aebb7f0a3ca65fcc682f523ace93641fbcfb9b09cfb71c739
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Cryptomining
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Cryptomining
                                                                                                                                                            • Size 32B
                                                                                                                                                            • SHA256 696e930706b5d391eb8778f73b0627ffc2be7f6c9a3e7659170d9d37fc4a97b5
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Entities
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Entities
                                                                                                                                                            • Size 106KB
                                                                                                                                                            • SHA256 0f305323c627cf0c790831c7e0bc38455b7a99983c4ab5bd9d2d9567766c3499
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Fingerprinting
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Fingerprinting
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 ec0fcbf71d58e707aaf6ba8d3c0719972f26727febe03f8efbf570b9635faddf
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LICENSE
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\LICENSE
                                                                                                                                                            • Size 66B
                                                                                                                                                            • SHA256 44071e0fcffb9a9a32e8fa7010bb18dbc41afd0b176f81bf700b15b638a88a51
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Other
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Other
                                                                                                                                                            • Size 198B
                                                                                                                                                            • SHA256 c9ab8dbc87043c71dd649fc06bb006e7f62e81c973c37b125afb88e654e436f8
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Social
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\Sigma\Social
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 e520603e6fb543cd078b2a7dbd8ccfc175e9aecf71654fc19785927a014d3435
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.fingerprint
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Trust Protection Lists\1.0.0.34\manifest.fingerprint
                                                                                                                                                            • Size 66B
                                                                                                                                                            • SHA256 f96cf59ef5cdf10cdebb367e16c6736d188af934062a8721eb9d60539556a2a9
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LICENSE
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\LICENSE
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            keys.json
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\TrustTokenKeyCommitments\2026.3.23.1\keys.json
                                                                                                                                                            • Size 8KB
                                                                                                                                                            • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Variations
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.WebView2\EBWebView\Variations
                                                                                                                                                            • Size 85B
                                                                                                                                                            • SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StormyExecutor.exe.config
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.exe.config
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 f74aac3bf64fd85530b6807a43209f743f46eeed026c2e0c0c9b9f2d44383d0a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StormyExecutor.pfx
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\StormyExecutor.pfx
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 51e34c4be9b7f703a0966ceff1d9ceb95e95f65f55446ce123672f6568ff1671
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            WebView2Loader.dll
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\runtimes\win-x64\native\WebView2Loader.dll
                                                                                                                                                            • Size 162KB
                                                                                                                                                            • SHA256 271b57e3ec03c436a15d80cafeb9fd1618a43793233d8b05c9446f8de0a51be4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            signtool.exe
                                                                                                                                                            • Path C:\ProgramData\StormyV3\StormyExtracted\BestStormy\signtool.exe
                                                                                                                                                            • Size 393KB
                                                                                                                                                            • SHA256 151e890cb8c6ff06eea28f4fca2d869864433092e740d7648000a3307bd74fbc
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            BookmarkMergedSurfaceOrdering
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                            • Size 6B
                                                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            BrowsingTopicsState
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                            • Size 414B
                                                                                                                                                            • SHA256 bc35b12fa40247ca0029084009703eb58d27abf6011e5d72fa767b46e5e47bac
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 672B
                                                                                                                                                            • SHA256 99d6c44212e66faddcf6213be024acd7fe50c648b010e170409170d383fc9965
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 9KB
                                                                                                                                                            • SHA256 63ddd5708aedba08c82acca0520e73f878f26520f3f93d164bd00f87650ea126
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 7KB
                                                                                                                                                            • SHA256 6f84c0882ddcaa92c3d2acb7186442205adbf3cf68c790d7fcec00a377826b86
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 7KB
                                                                                                                                                            • SHA256 9a4cd25788a297a171def32bdf45474f4cbb338e670b194038b3f36d223507cf
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 8KB
                                                                                                                                                            • SHA256 c2deb8c2da2df996c8198108cb4a30def1d3d5cc0fd243dfdee010c5f628deb9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            TransportSecurity
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                            • Size 1024B
                                                                                                                                                            • SHA256 43745c21a3915ec46fa60b812eee0b2e37a82891b62f564042f58011f3950cca
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                            • Size 13KB
                                                                                                                                                            • SHA256 35e212f011a3044720548d37689527e61c03f30761202ae004c61369f58eef5b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                            • Size 14KB
                                                                                                                                                            • SHA256 cb8025d7fe3178b268f46f18b288f757e0368e384046afe9dbb015921d3714e4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                            • Size 12KB
                                                                                                                                                            • SHA256 329f79c4258ca5b94eb4e45522db1d02861ca8ba05ee09b29a764a7fbcc283f4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                            • Size 14KB
                                                                                                                                                            • SHA256 f43288eb409a86a5a218fa30fcd3301b8354f44d04cdbb16ec105e15ee2faa94
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Secure Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                            • Size 17KB
                                                                                                                                                            • SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                            • Size 120B
                                                                                                                                                            • SHA256 5fe5f54ca3efa0e5cdaa00f33774e58fc13b081755d00851b0d5358b8e68b469
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index~RFe588112.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588112.TMP
                                                                                                                                                            • Size 96B
                                                                                                                                                            • SHA256 7b47dbceea52706a0b61bac286c0077d8e1a7ca2f303c3b6f81f6a0ac409ae16
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                            • Size 233KB
                                                                                                                                                            • SHA256 3a256d250dadea42fd0756697384794dc91054b707ff08dda8f173e5641f1bba
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                            • Size 234KB
                                                                                                                                                            • SHA256 f5610c4e7533dfc8df52fad64873f8615c3e1a402573258631d62c26ccd739da
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                            • Size 234KB
                                                                                                                                                            • SHA256 06886c9596c2e2252142e5baddc1a740a0773aaac275727d5a118e0b76d9ae76
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                            • Size 233KB
                                                                                                                                                            • SHA256 290cc78587b8d83701776d74b8c9f39e72e272ca2ce6d8d4701493bfb833c465
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                            • Size 115KB
                                                                                                                                                            • SHA256 135f5a64588f7152a2df4d8a3ed4750b8d7db7977b2a8f7c57080d6a5be8ef94
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            powershell.exe.log
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 731cc429b042f5d7d4568f697fc298227c82b5aa3e923b8f6d2693ab59f4a92a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 1b088d9e84e9d3c7b0640140ebcb279272e8bbc10bcf528807a7d61de9d5085f
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LOG.old
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                            • Size 357B
                                                                                                                                                            • SHA256 f69c95cf5664db1d8daa7b56d3b3020a8678b89e5cceba2ff18e949dc08f7186
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            MANIFEST-000001
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
                                                                                                                                                            • Size 268B
                                                                                                                                                            • SHA256 1bde510a8acdd1d135fbd1d26695a7177a38cad7616e7840b7d88ef57f9430b8
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            BrowsingTopicsState
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                                            • Size 414B
                                                                                                                                                            • SHA256 7ffebc2a10573bc7bfc09b07a75a731f05892027d2619187cf94f4a51e38302b
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 7be22cc3b13c2ef21066480b295a187d7c33b185c32331c06f900332d5cf377b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index~RFe5a08bc.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a08bc.TMP
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 ce9ed6a94d11a47cc256b4e0444219fed0ec90cb87129e60039bc5103a3fde9f
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            SiteList-Enterprise.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 1356350c4c9892361d2220a23acfb23c32c7f30383a58711b2d4e74f9a2be3d8
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 b2a729e96285e2629d6efb5a806edec21b17c7d266d73e9fb544082427a1bcc1
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            TransportSecurity
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                                            • Size 351B
                                                                                                                                                            • SHA256 46a741f479d54dbaeb7fd2b50414c9d5d1bd6cc104e86095e2ba49cb02019f77
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 16KB
                                                                                                                                                            • SHA256 3a55209508a537965fd17d91896487afce34b3e68abb7e75ee7ca11199dc558e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Secure Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                            • Size 37KB
                                                                                                                                                            • SHA256 cccdc8f7cb3535498be9c4b6ffabda2bca72cb9369eaec660bf40df58a391053
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            index.txt
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                            • Size 226B
                                                                                                                                                            • SHA256 6e3e6b5f5529bcd1d288d79e76b58504aa5b00d335ac540c6f244a2cbb6d9323
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            index.txt~RFe59f90c.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe59f90c.TMP
                                                                                                                                                            • Size 138B
                                                                                                                                                            • SHA256 6d1824865c70e4d0ffe840117729d18af269e2dcc519950f2f9faf7ad1bca254
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            sync_diagnostic.log
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                            • Size 23KB
                                                                                                                                                            • SHA256 3334a4713b5095aa25d74d7cc61827af881a94a0b5b9c4e6a0163e0ec5eefdb2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            data.txt
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.16\data.txt
                                                                                                                                                            • Size 149KB
                                                                                                                                                            • SHA256 580e3960965784145b5800f35bb9532b3990baedee473ace87b7bb28fdf7791e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            office_endpoints_list.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                                                                                                            • Size 9KB
                                                                                                                                                            • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            wallet-checkout-eligible-sites.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
                                                                                                                                                            • Size 23KB
                                                                                                                                                            • SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            wallet-notification-config.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
                                                                                                                                                            • Size 804B
                                                                                                                                                            • SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            wallet-stable.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
                                                                                                                                                            • Size 81KB
                                                                                                                                                            • SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            wallet-tokenization-config.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
                                                                                                                                                            • Size 34KB
                                                                                                                                                            • SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 26KB
                                                                                                                                                            • SHA256 5d86e63a8b8387fa86e119a9f75e280dd6135ffe38e3baaaf94ef48edb2016b4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 30KB
                                                                                                                                                            • SHA256 68ac832ff86e3ef5d44e8fc54012419336bb1892e801478a15eaf9be39e7d07e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 25KB
                                                                                                                                                            • SHA256 0dc0e2eef7084c5d7cee4f6c834b6d8836a0f365e12e7ea48b0fd256ad8c975c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 24KB
                                                                                                                                                            • SHA256 47a094fb5e8146652017b4b32335b4d91155dc2da23dfba3b200a0ebafa08375
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 24KB
                                                                                                                                                            • SHA256 0c95202bd8f220a7612071170ee7ff8c79ace0911ecd0074744bc39fd0285d5a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 25KB
                                                                                                                                                            • SHA256 f00d7bfd1f5824b2b969536d30350278c79bfaecdef337949710912e1af7f619
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            typosquatting_list.pb
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.7.1.2\typosquatting_list.pb
                                                                                                                                                            • Size 668KB
                                                                                                                                                            • SHA256 285655c896535d1813cc24522c142e3348d708ae63455f8d1ad51f90ed77cb60
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 ba8297265d7748cb8b218bf70c7c70f2e7ffa4350bd05b1e0df9e6d373e6b65f
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 1330e67aa6780e71c629ed7a388747e60b101b8a040e88491b8eaa21212d817a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 adf8b02bd5c8752dd904e25a76bde2ba330ec90f218fbebcf9dac2fa855b0139
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 25b5f40821a6065d78221ef100371ef44c9d8a2a0a0a7f070997d80f0ad250f2
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 bfca6d61e4bc3d91a293379676878482121dd9722951b8c2c8403eb336a5f855
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 59041d0dd584953fd3f40ef45ae258f0d3ad49b5d5c064d97081d4a967b7f3ef
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                                                                                            • Size 152KB
                                                                                                                                                            • SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                            • Size 132B
                                                                                                                                                            • SHA256 9ba64fdf12690bc24af750ffc8e144edc5fda28e40b47c6637e36760d82fc03a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 b0055e04347b1f2e63eca144a5322b28271d5d1be131785aab20bf0ccfddfd45
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 21940edd258e3d8e47562617ce3af08b7aaf359297cae64558dce4158016ce0c
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StartupProfileData-NonInteractive
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 8ca943c02c163cdf5099c1a6f7795399ec72d9d3520f97e01b2cc3fa5a381d5d
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            32548719-3830-4e2a-ab86-80b253625c59.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\32548719-3830-4e2a-ab86-80b253625c59.tmp
                                                                                                                                                            • Size 1B
                                                                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            CreateStormyShortcut.ps1
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\CreateStormyShortcut.ps1
                                                                                                                                                            • Size 846B
                                                                                                                                                            • SHA256 8744d0ac09bb873be2d5580b25b17922813e5c64c77660ac9246db60c9933e3d
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            __PSScriptPolicyTest_wi1g1hwr.ho2.ps1
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wi1g1hwr.ho2.ps1
                                                                                                                                                            • Size 60B
                                                                                                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            467121EFDA51B6C297D4C17D88501F4FA9A58933
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\467121EFDA51B6C297D4C17D88501F4FA9A58933
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 632c9143de73b9c3efe91eee54acb2b683246cc79d37d73c9919b598ef2d7f67
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            467121EFDA51B6C297D4C17D88501F4FA9A58933
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\467121EFDA51B6C297D4C17D88501F4FA9A58933
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 a8dfbec2b963d095521066622c5da5d683b9b9e538622dedfb5f5b78c804c844
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 629050b950fd984c6f88bd769cb3dfc56fa1bd471ef2ff39c105f0da9df334f0
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 257751b8c87801104605850c406dfc49db47d09af8928644090d40d35f8a4f59
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                                                                                            • Size 6KB
                                                                                                                                                            • SHA256 10797c56ed93a07733db86b988f8210b8abff3e23c862c13ae9f10b7132b0ecd
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Stormy.lnk
                                                                                                                                                            • Path C:\Users\Admin\Desktop\Stormy.lnk
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 c4f992052f9a95c6307e8384c67ab1da4ab4459a41251717ec41adb173165420
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            StormyV3Bootrapper.exe:Zone.Identifier
                                                                                                                                                            • Path C:\Users\Admin\Downloads\StormyV3Bootrapper.exe:Zone.Identifier
                                                                                                                                                            • Size 181B
                                                                                                                                                            • SHA256 1de7f6a27f63f019706b1112d7ace3d00d6536d004e7f80cf1457d593577bbc8
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Unconfirmed 59057.crdownload
                                                                                                                                                            • Path C:\Users\Admin\Downloads\Unconfirmed 59057.crdownload
                                                                                                                                                            • Size 6.6MB
                                                                                                                                                            • SHA256 60af178b1dee59c9e021a3de8321bdf955543d6ac061aa6157d6a979f8e96a0a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1155947026\manifest.json
                                                                                                                                                            • Size 53B
                                                                                                                                                            • SHA256 bfbac34c5248ceb22d32686e058a8c3701ea99db66902c754faf19862bd4808c
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1337342929\manifest.json
                                                                                                                                                            • Size 117B
                                                                                                                                                            • SHA256 2679e1e5c5fbbdca9b0c5081ca7128c4c4957ce8e19f4e34736e7e41c9992169
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LICENSE
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1788004014\LICENSE
                                                                                                                                                            • Size 499B
                                                                                                                                                            • SHA256 55064d7d8fecdd90ba36cebaff34f05583c183b34686b17b40b974442fc07523
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            verified_contents.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1788004014\_metadata\verified_contents.json
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 823f4c1b200082df810d789bef9f02f04dcea5019b5595139d2fe8c02bc9556e
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            widevinecdm.dll
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1788004014\_platform_specific\win_x64\widevinecdm.dll
                                                                                                                                                            • Size 18.9MB
                                                                                                                                                            • SHA256 bf7d46b38690e50462fecbc14530cd903d1486fa493b49d9e71d6cc44ac25a4b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            widevinecdm.dll.sig
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_1788004014\_platform_specific\win_x64\widevinecdm.dll.sig
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 3d01ea299dbfa7dd3dcd5959aa70234e18e825136c33c9079b1e50db4c8a89fb
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            edge_checkout_page_validator.js
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_187004054\edge_checkout_page_validator.js
                                                                                                                                                            • Size 1009KB
                                                                                                                                                            • SHA256 04047fbad72cb02b113ee3a1f1823227aac74e1615fc5fa359d11776c727259c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_187004054\manifest.json
                                                                                                                                                            • Size 146B
                                                                                                                                                            • SHA256 c97cc8be28f97c110b37ace786188903f2f1c9d6736e5b0ebd875d900340f4a1
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            notification_fast.bundle.js.LICENSE.txt
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_439117728\Notification\notification_fast.bundle.js.LICENSE.txt
                                                                                                                                                            • Size 551B
                                                                                                                                                            • SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_439117728\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            strings.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_439117728\json\i18n-tokenized-card\fr-CA\strings.json
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_439117728\manifest.json
                                                                                                                                                            • Size 121B
                                                                                                                                                            • SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            llm_user_input_extractor_config.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_579354876\llm_user_input_extractor_config.json
                                                                                                                                                            • Size 4KB
                                                                                                                                                            • SHA256 2056ee7ed0e7adb69344c93a024158ee4e2332ecd50d183dbad7595c4d588ed9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3888_579354876\manifest.json
                                                                                                                                                            • Size 165B
                                                                                                                                                            • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LICENSE
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1098564620\LICENSE
                                                                                                                                                            • Size 24KB
                                                                                                                                                            • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1098564620\manifest.json
                                                                                                                                                            • Size 116B
                                                                                                                                                            • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1291057537\manifest.json
                                                                                                                                                            • Size 1001B
                                                                                                                                                            • SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1365101966\manifest.json
                                                                                                                                                            • Size 69B
                                                                                                                                                            • SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            crs.pb
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1369580478\crs.pb
                                                                                                                                                            • Size 233KB
                                                                                                                                                            • SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1369580478\manifest.json
                                                                                                                                                            • Size 102B
                                                                                                                                                            • SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Staging
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1543931587\Sigma\Staging
                                                                                                                                                            • Size 36B
                                                                                                                                                            • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_1543931587\manifest.json
                                                                                                                                                            • Size 132B
                                                                                                                                                            • SHA256 68683970ce6d7de9a2043c34129106ae68af21a3b0a3c53cb59695640a7c1cbc
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_629935235\manifest.json
                                                                                                                                                            • Size 79B
                                                                                                                                                            • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_643243205\manifest.json
                                                                                                                                                            • Size 135B
                                                                                                                                                            • SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            manifest.json
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6068_777923177\manifest.json
                                                                                                                                                            • Size 113B
                                                                                                                                                            • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            memory/1292-0-0x0000025D23C90000-0x0000025D24376000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1292-1-0x0000025D3FED0000-0x0000025D3FEE0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2148-1174-0x000002AEBCCA0000-0x000002AEBCCC2000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2148-1187-0x000002AED5620000-0x000002AED563C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2148-1190-0x000002AED5880000-0x000002AED589C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2148-1188-0x000002AED5640000-0x000002AED56F3000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2148-1189-0x000002AED5700000-0x000002AED570A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2348-1540-0x00007FF9F1780000-0x00007FF9F1781000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/3904-1308-0x0000019DFA400000-0x0000019DFA500000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/3904-1430-0x0000019EFF5F0000-0x0000019EFF6F0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/3904-1349-0x0000019EFD9E0000-0x0000019EFDA00000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/3904-1350-0x0000019DFD240000-0x0000019DFD260000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3075-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3083-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3084-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3076-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3080-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3086-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3082-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3081-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3085-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4596-3074-0x000001868E820000-0x000001868E821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5388-177-0x0000026DF6F80000-0x0000026DF7192000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5388-211-0x0000026DF7C80000-0x0000026DF7C8A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5388-176-0x0000026DDC0B0000-0x0000026DDC74E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5388-226-0x0000026DF7C50000-0x0000026DF7C62000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5552-1570-0x00007FF9F1780000-0x00007FF9F1781000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1281-0x000001B2E6370000-0x000001B2E6918000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1283-0x000001B2E6D10000-0x000001B2E6F24000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1524-0x000001B2E8530000-0x000001B2E854A000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1606-0x000001B2E7770000-0x000001B2E778E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1605-0x000001B2E78D0000-0x000001B2E7946000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1453-0x000001B2F0310000-0x000001B2F03A8000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1523-0x000001B2E6AC0000-0x000001B2E6AD0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1451-0x000001B2EC670000-0x000001B2EC67E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1604-0x000001B2E7810000-0x000001B2E78C2000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5696-1266-0x000001B2CB820000-0x000001B2CBCCA000-memory.dmp
                                                                                                                                                            Download