Windows Analysis Report
TU1ocSt1kw.exe

Overview

General Information

Sample name:	TU1ocSt1kw.exe renamed because original name is a hash value
Original sample name:	89f65ad79caa39d402fc618dd3a49148.exe
Analysis ID:	1537102
MD5:	89f65ad79caa39d402fc618dd3a49148
SHA1:	3813282fab620579a437e3ca4f290fd41ef26f82
SHA256:	7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636
Tags:	64exe
Infos:

Detection

HackBrowser

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected HackBrowser

AI detected suspicious sample

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
HackBrowserData	Browser information stealer, written in Go.	No Attribution	https://blog.eclecticiq.com/operation-flightnight-indian-government-entities-and-energy-sector-targeted-by-cyber-espionage-campaign	https://malpedia.caad.fkie.fraunhofer.de/details/win.hackbrowserdata

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: TU1ocSt1kw.exe

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: TU1ocSt1kw.exe

Joe Sandbox ML: detected

Source: TU1ocSt1kw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: time.windows.com

Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://file://mailto:http://BINARY-x0X03.46.0
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore/detail/crypto/sha1:
Source: TU1ocSt1kw.exe, 00000000.00000003.1382129067.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1382168430.000000C000086000.00000004.00001000.00020000.00000000.sdmp, microsoft_edge_default_extension.csv.0.dr	String found in binary or memory: https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: TU1ocSt1kw.exe, 00000000.00000003.1382016505.000000C0000C6000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388370296.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhie
Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/moonD4rk/HackBrowserData
Source: TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1386894833.000000C000056000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signature
Source: TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureC:
Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdsync:
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://support.mozilla.org
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: TU1ocSt1kw.exe, 00000000.00000002.1390963797.000000C001153000.00000004.00001000.00020000.00000000.sdmp, places.sqlite_16.temp.0.dr, places.sqlite_15.temp.0.dr, places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: TU1ocSt1kw.exe, 00000000.00000002.1390963797.000000C001153000.00000004.00001000.00020000.00000000.sdmp, places.sqlite_16.temp.0.dr, places.sqlite_15.temp.0.dr, places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: classification engine

Classification label: mal68.troj.spyw.winEXE@2/39@2/0

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

File created: C:\Users\user\Desktop\results

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

File created: C:\Users\user~1\AppData\Local\Temp\Login Data_1.temp

Jump to behavior

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

File opened: C:\Windows\system32\6f30339b6280b4bdd7e4ab555d0b4547d488ddce3c8b365cd3502f7dde4f60deAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: TU1ocSt1kw.exe, 00000000.00000003.1374867483.0000024EFAEF5000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1378339803.000000C000385000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1377665826.0000024EFAF85000.00000004.00001000.00020000.00000000.sdmp, Login Data_1.temp.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: TU1ocSt1kw.exe

ReversingLabs: Detection: 13%

Source: TU1ocSt1kw.exe	String found in binary or memory: ts but cannot be invoked as functionflag verification failed: password-check not foundhttps://microsoftedge.microsoft.com/addons/detail/crypto/cipher: incorrect nonce length given to GCM %3d \| %10d \| %13.5f \| %13.5f \| %13.5f \| %13.5f GetFinalPathNameByHandle
Source: TU1ocSt1kw.exe	String found in binary or memory: net/addrselect.go
Source: TU1ocSt1kw.exe	String found in binary or memory: econds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanLi
Source: TU1ocSt1kw.exe	String found in binary or memory: econds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanLi
Source: TU1ocSt1kw.exe	String found in binary or memory: bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=run
Source: TU1ocSt1kw.exe	String found in binary or memory: bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=run

Source: unknown	Process created: C:\Users\user\Desktop\TU1ocSt1kw.exe "C:\Users\user\Desktop\TU1ocSt1kw.exe"
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: TU1ocSt1kw.exe

Static file information: File size 3626496 > 1048576

Source: TU1ocSt1kw.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x375200

Source: TU1ocSt1kw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains sections with non-standard names

Source: TU1ocSt1kw.exe

Static PE information: section name: UPX2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data_6.temp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data_6.temp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data_6.temp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data_6.temp.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: TU1ocSt1kw.exe, 00000000.00000002.1391773485.0000024EF5874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data_6.temp.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data_6.temp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data_6.temp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data_6.temp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data_6.temp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data_6.temp.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Web Data_6.temp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data_6.temp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\WidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\segmentation_platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\45553bce-41a3-4fff-adb5-94a1080d3389 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_metadata_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Fre VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\1.15.0.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231004.1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected HackBrowser

Source: Yara match	File source: 0.2.TU1ocSt1kw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TU1ocSt1kw.exe PID: 5496, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log	Jump to behavior

Remote Access Functionality

Yara detected HackBrowser

Source: Yara match	File source: 0.2.TU1ocSt1kw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TU1ocSt1kw.exe PID: 5496, type: MEMORYSTR

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
time.windows.com	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user~1\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT (copy)	ASCII text	9F36605EFBA98DAB15728FE8B5538AA0	6A7CFF514AE159A59B70F27DDE52A3A5DD01B1C8	9C283F6E81028B9EB0760D918EE4BC0AA256ED3B926393C1734C760C4BD724FD
C:\Users\user~1\AppData\Local\Temp\Session Storage_8.temp\CURRENT (copy)	ASCII text	AEFD77F47FB84FAE5EA194496B44C67A	DCFBB6A5B8D05662C4858664F81693BB7F803B82	4166BF17B2DA789B0D0CC5C74203041D98005F5D4EF88C27E8281E00148CD611
C:\Users\user\AppData\Local\Temp\Cookies_2.temp	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7	CFFF4E2B77FC5A18AB6323AF9BF95339	3AA2C2115A8EB4516049600E8832E9BFFE0C2412	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
C:\Users\user\AppData\Local\Temp\History_4.temp	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1	7B955D976803304F2C0505431A0CF1CF	E29070081B18DA0EF9D98D4389091962E3D37216	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
C:\Users\user\AppData\Local\Temp\History_5.temp	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1	7B955D976803304F2C0505431A0CF1CF	E29070081B18DA0EF9D98D4389091962E3D37216	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
C:\Users\user\AppData\Local\Temp\Local State_0.temp	JSON data	35E04408556B5F409774D2CF2BD07814	A1131C0B9C944E455A11625C9812631ACBB2580D	E18519773390D2BD33BEC9CDDA152B64D84575411132E4FA316A1D07DD253F2D
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.5	ASCII text	9F36605EFBA98DAB15728FE8B5538AA0	6A7CFF514AE159A59B70F27DDE52A3A5DD01B1C8	9C283F6E81028B9EB0760D918EE4BC0AA256ED3B926393C1734C760C4BD724FD
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.bak	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\LOG	Unicode text, UTF-8 text	44CF25FE3760805DC587CADAE3A5ADFE	D63EA01E60DB6310D5F9D8A85E3A6F1A9F4CCB04	BDC68392A5BA2DC40D2BB48018C6CB50F2C02108421BA542350B86BC2FD3087E
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\LOG.old	ASCII text	C7DD0E003D79550803C76E5E9F7320B0	2B4B85016FC808769E6EA4A8D6DA43F0284DF3FD	AC4B1ADB6F6B2B2794BC3CCEB88F60365478E995225B42FDCBB406D6882DF126
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000005	data	EACDD7DE767B7664FAE36AC76F46650E	B3BFE4D7CD7CB7DBF8DB57345CCB2341FEDEFBDB	5F53C3A8000D02EF8705A6D15E0D237C389A7189106FD954D9B4B7E5D1763360
C:\Users\user\AppData\Local\Temp\Login Data_1.temp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1	9E68EA772705B5EC0C83C2A97BB26324	243128040256A9112CEAC269D56AD6B21061FF80	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
C:\Users\user\AppData\Local\Temp\Secure Preferences_9.temp	JSON data	CA22DD8690ED12578E1F5C991E5C8CB2	DE811C29601C1F23AE93308071473E7BBA12926E	F7BE9DC8DAB56562753A0FCBC3DBDBCE9101346FCF8F7CE8288257A3EF4755BC
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\000003.log	data	9F7EADC15E13D0608B4E4D590499AE2E	AFB27F5C20B117031328E12DD3111A7681FF8DB5	5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\000004.ldb	TeX font metric data	800964100BF5522029908E4D62C8CB86	28FA46CA8B867B24975FFA2E164A08DCB8C3838D	4320E36C155668FAF70DF6378ED4748E176A45F9B38996F5529FB8DBAF7A46BE
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT.5	ASCII text	9F36605EFBA98DAB15728FE8B5538AA0	6A7CFF514AE159A59B70F27DDE52A3A5DD01B1C8	9C283F6E81028B9EB0760D918EE4BC0AA256ED3B926393C1734C760C4BD724FD
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT.6	ASCII text	AEFD77F47FB84FAE5EA194496B44C67A	DCFBB6A5B8D05662C4858664F81693BB7F803B82	4166BF17B2DA789B0D0CC5C74203041D98005F5D4EF88C27E8281E00148CD611
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak	ASCII text	46295CAC801E5D4857D09837238A6394	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\LOG	Unicode text, UTF-8 text	5134536E2879B3F56B9B317B8308323C	2FEAC35970537B5E977D97C9447C975DCA66CBCF	95C8609E05088EE417D931C2ED35BC1AAB10D3FCDAE4660B60EE16956C3B3B4F
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\LOG.old	ASCII text	91E8A6F2463AEDA2BF0C6FE22B692A06	0A68B9F005541E31EDFC1150F183B4E7BE19311F	53607FF4C92044441DD6FDE498DE12057043DA81E0329D8F1812EA383068960D
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001	OpenPGP Secret Key	5AF87DFD673BA2115E2FCF5CFDB727AB	D5B5BBF396DC291274584EF71F444F420B6056F1	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000005	data	EACDD7DE767B7664FAE36AC76F46650E	B3BFE4D7CD7CB7DBF8DB57345CCB2341FEDEFBDB	5F53C3A8000D02EF8705A6D15E0D237C389A7189106FD954D9B4B7E5D1763360
C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000006	data	3FBD42704B3E54B1FCB9F37E4656D34D	40EFC18C07B4714C58D512AAAE3369CDB4B63598	76816EA4B1D419811B52D7571F24C7DA87A8832A475A1D3CA64931488A37BCA3
C:\Users\user\AppData\Local\Temp\Web Data_6.temp	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7	9A809AD8B1FDDA60760BB6253358A1DB	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
C:\Users\user\AppData\Local\Temp\cookies.sqlite_14.temp	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3	369B6DD66F1CAD49D0952C40FEB9AD41	D05B2DE29433FB113EC4C558FF33087ED7481DD4	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
C:\Users\user\AppData\Local\Temp\extensions.json_21.temp	JSON data	C2A8F76D683C9F86054CA7775732A180	FB1F8B84825D53E58290E53D65F8A73C5794E281	4744AACB03666A594CF1BB6E6491105F0AB600259D8E0BA483164F2AE9C90221
C:\Users\user\AppData\Local\Temp\key4.db_12.temp	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2	2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D	14DFBE9B28D033542357D98005239D842A16FCFD	91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
C:\Users\user\AppData\Local\Temp\places.sqlite_15.temp	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2	4BB4A37B8E93E9B0F5D3DF275799D45E	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
C:\Users\user\AppData\Local\Temp\places.sqlite_16.temp	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2	4BB4A37B8E93E9B0F5D3DF275799D45E	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
C:\Users\user\AppData\Local\Temp\places.sqlite_17.temp	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2	4BB4A37B8E93E9B0F5D3DF275799D45E	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
C:\Users\user\AppData\Local\Temp\webappsstore.sqlite_19.temp	SQLite 3.x database, user version 2, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2	72BCFF6B14E4D56701817BDC948967AA	8BB20201B2162FEFF149BA0281426FA1A67697C4	741EE4D7724BEF132AA68BE667DDD8CB462A2DB886156280113018B4FB774ACD
C:\Users\user\Desktop\results\chrome_default_cookie.csv	CSV text	C4CE27103DA2C69B363EFB04D2BD8FE6	9D2B24B68FB5892873558BE8A6AB01D8FE977517	634282F0EE15CC081D610E28B2C7B6557CAE5EAC723D91DA9A76C21EC315C0C4
C:\Users\user\Desktop\results\chrome_default_sessionstorage.csv	Unicode text, UTF-8 (with BOM) text	D07886F7107C50304E1B9CDE0793ED04	41453A6E9DB25A06B4EF031C12FDCEE8A3818741	963B596F0385F5BE1B8AD2F7E5B4FF474AEB1A1A8D17D20FF67A1CD30CA70344
C:\Users\user\Desktop\results\microsoft_edge_def_sessionstorage.csv	Unicode text, UTF-8 (with BOM) text	D07886F7107C50304E1B9CDE0793ED04	41453A6E9DB25A06B4EF031C12FDCEE8A3818741	963B596F0385F5BE1B8AD2F7E5B4FF474AEB1A1A8D17D20FF67A1CD30CA70344
C:\Users\user\Desktop\results\microsoft_edge_default_extension.csv	Unicode text, UTF-8 (with BOM) text	37C3615B27EF78CFF8F32152D06BA44D	038B34850087E3A7B8C39779DC3C9DF1E263B28C	25D98741BB87553607C471C6DC30614CABCFFFEEF074D1A3562DB98BCB198A82
C:\Users\user\Desktop\results\microsoft_edge_default_sessionstorage.csv	Unicode text, UTF-8 (with BOM) text	D07886F7107C50304E1B9CDE0793ED04	41453A6E9DB25A06B4EF031C12FDCEE8A3818741	963B596F0385F5BE1B8AD2F7E5B4FF474AEB1A1A8D17D20FF67A1CD30CA70344

AV Detection

Multi AV Scanner detection for submitted file

Source: TU1ocSt1kw.exe

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for sample

Source: TU1ocSt1kw.exe

Joe Sandbox ML: detected

Source: TU1ocSt1kw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: time.windows.com

Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://file://mailto:http://BINARY-x0X03.46.0
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome.google.com/webstore/detail/crypto/sha1:
Source: TU1ocSt1kw.exe, 00000000.00000003.1382129067.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1382168430.000000C000086000.00000004.00001000.00020000.00000000.sdmp, microsoft_edge_default_extension.csv.0.dr	String found in binary or memory: https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: TU1ocSt1kw.exe, 00000000.00000003.1382016505.000000C0000C6000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388370296.000000C0000C8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhie
Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/moonD4rk/HackBrowserData
Source: TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1386894833.000000C000056000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signature
Source: TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureC:
Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdsync:
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://support.mozilla.org
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: TU1ocSt1kw.exe, 00000000.00000002.1390963797.000000C001153000.00000004.00001000.00020000.00000000.sdmp, places.sqlite_16.temp.0.dr, places.sqlite_15.temp.0.dr, places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: TU1ocSt1kw.exe, 00000000.00000002.1390963797.000000C001153000.00000004.00001000.00020000.00000000.sdmp, places.sqlite_16.temp.0.dr, places.sqlite_15.temp.0.dr, places.sqlite_17.temp.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: classification engine

Classification label: mal68.troj.spyw.winEXE@2/39@2/0

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

File created: C:\Users\user\Desktop\results

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

File created: C:\Users\user~1\AppData\Local\Temp\Login Data_1.temp

Jump to behavior

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

Jump to behavior

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: TU1ocSt1kw.exe, 00000000.00000003.1374867483.0000024EFAEF5000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1378339803.000000C000385000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1377665826.0000024EFAF85000.00000004.00001000.00020000.00000000.sdmp, Login Data_1.temp.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: TU1ocSt1kw.exe

ReversingLabs: Detection: 13%

Source: TU1ocSt1kw.exe	String found in binary or memory: ts but cannot be invoked as functionflag verification failed: password-check not foundhttps://microsoftedge.microsoft.com/addons/detail/crypto/cipher: incorrect nonce length given to GCM %3d \| %10d \| %13.5f \| %13.5f \| %13.5f \| %13.5f GetFinalPathNameByHandle
Source: TU1ocSt1kw.exe	String found in binary or memory: net/addrselect.go
Source: TU1ocSt1kw.exe	String found in binary or memory: econds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanLi
Source: TU1ocSt1kw.exe	String found in binary or memory: econds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanLi
Source: TU1ocSt1kw.exe	String found in binary or memory: bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=run
Source: TU1ocSt1kw.exe	String found in binary or memory: bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=run

Source: unknown	Process created: C:\Users\user\Desktop\TU1ocSt1kw.exe "C:\Users\user\Desktop\TU1ocSt1kw.exe"
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: TU1ocSt1kw.exe

Static file information: File size 3626496 > 1048576

Source: TU1ocSt1kw.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x375200

Source: TU1ocSt1kw.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains sections with non-standard names

Source: TU1ocSt1kw.exe

Static PE information: section name: UPX2

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Web Data_6.temp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Web Data_6.temp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Web Data_6.temp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Web Data_6.temp.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: TU1ocSt1kw.exe, 00000000.00000002.1391773485.0000024EF5874000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data_6.temp.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Web Data_6.temp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Web Data_6.temp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Web Data_6.temp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Web Data_6.temp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Web Data_6.temp.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Web Data_6.temp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: Web Data_6.temp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Web Data_6.temp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Web Data_6.temp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Web Data_6.temp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\WidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\segmentation_platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\45553bce-41a3-4fff-adb5-94a1080d3389 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_metadata_store VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Fre VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ar VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\de VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\en-GB VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\es VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\id VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\it VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ja VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\nl VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-BR VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-PT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ru VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\sv VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hans VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hant VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\1.15.0.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231004.1.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.4 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes VolumeInformation	Jump to behavior

Stealing of Sensitive Information

Yara detected HackBrowser

Source: Yara match	File source: 0.2.TU1ocSt1kw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TU1ocSt1kw.exe PID: 5496, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOG	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Users\user\Desktop\TU1ocSt1kw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log	Jump to behavior

Remote Access Functionality

Yara detected HackBrowser

Source: Yara match	File source: 0.2.TU1ocSt1kw.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: TU1ocSt1kw.exe PID: 5496, type: MEMORYSTR

ID:	1537102
Product:	CloudBasic
Start time:	15:12:05
Start date:	18.10.2024
Sample:	TU1ocSt1kw.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	89f65ad79caa39d402fc618dd3a49148
SHA1:	3813282fab620579a437e3ca4f290fd41ef26f82
SHA256:	7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636
Filetype:	Win64 Executable Console (202006/5) 81.26%

Windows Analysis Report
TU1ocSt1kw.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report TU1ocSt1kw.exe

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
TU1ocSt1kw.exe

Malware Threat Intel
Provided by