Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
TU1ocSt1kw.exe

Overview

General Information

Sample name:TU1ocSt1kw.exe
renamed because original name is a hash value
Original sample name:89f65ad79caa39d402fc618dd3a49148.exe
Analysis ID:1537102
MD5:89f65ad79caa39d402fc618dd3a49148
SHA1:3813282fab620579a437e3ca4f290fd41ef26f82
SHA256:7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636
Tags:64exe
Infos:

Detection

HackBrowser
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected HackBrowser
AI detected suspicious sample
Machine Learning detection for sample
Tries to harvest and steal browser information (history, passwords, etc)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device

Classification

Process Tree

  • System is w10x64
  • TU1ocSt1kw.exe (PID: 5496 cmdline: "C:\Users\user\Desktop\TU1ocSt1kw.exe" MD5: 89F65AD79CAA39D402FC618DD3A49148)
    • conhost.exe (PID: 6768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
HackBrowserDataBrowser information stealer, written in Go.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.hackbrowserdata

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_HackBrowserYara detected HackBrowserJoe Security
    Process Memory Space: TU1ocSt1kw.exe PID: 5496JoeSecurity_HackBrowserYara detected HackBrowserJoe Security

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      0.2.TU1ocSt1kw.exe.4f0000.0.unpackJoeSecurity_HackBrowserYara detected HackBrowserJoe Security

        Sigma Signatures

        ⊘No Sigma rule has matched

        Suricata Signatures

        ⊘No Suricata rule has matched

        Joe Sandbox Signatures

        Click to jump to signature section

        Show All Signature Results

        AV Detection

        barindex
        Multi AV Scanner detection for submitted file
        Source: TU1ocSt1kw.exeReversingLabs: Detection: 13%
        AI detected suspicious sample
        Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.5% probability
        Machine Learning detection for sample
        Source: TU1ocSt1kw.exeJoe Sandbox ML: detected
        Source: TU1ocSt1kw.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
        Source: global trafficDNS traffic detected: DNS query: time.windows.com
        Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://file://mailto:http://BINARY-x0X03.46.0
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
        Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/crypto/sha1:
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382129067.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1382168430.000000C000086000.00000004.00001000.00020000.00000000.sdmp, microsoft_edge_default_extension.csv.0.drString found in binary or memory: https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhi
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382016505.000000C0000C6000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388370296.000000C0000C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhie
        Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx
        Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-autopush.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-0.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-1.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-2.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-3.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-4.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-5.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-daily-6.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-preprod.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive-staging.corp.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://drive.google.com/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
        Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/moonD4rk/HackBrowserData
        Source: TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1386894833.000000C000056000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signature
        Source: TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureC:
        Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdsync:
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://support.mozilla.org
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
        Source: TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://www.mozilla.org
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
        Source: TU1ocSt1kw.exe, 00000000.00000002.1390963797.000000C001153000.00000004.00001000.00020000.00000000.sdmp, places.sqlite_16.temp.0.dr, places.sqlite_15.temp.0.dr, places.sqlite_17.temp.0.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
        Source: places.sqlite_17.temp.0.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
        Source: TU1ocSt1kw.exe, 00000000.00000002.1390963797.000000C001153000.00000004.00001000.00020000.00000000.sdmp, places.sqlite_16.temp.0.dr, places.sqlite_15.temp.0.dr, places.sqlite_17.temp.0.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
        Source: classification engineClassification label: mal68.troj.spyw.winEXE@2/39@2/0
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile created: C:\Users\user\Desktop\resultsJump to behavior
        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6768:120:WilError_03
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile created: C:\Users\user~1\AppData\Local\Temp\Login Data_1.tempJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Windows\system32\6f30339b6280b4bdd7e4ab555d0b4547d488ddce3c8b365cd3502f7dde4f60deAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
        Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
        Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
        Source: TU1ocSt1kw.exe, 00000000.00000003.1374867483.0000024EFAEF5000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1378339803.000000C000385000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1377665826.0000024EFAF85000.00000004.00001000.00020000.00000000.sdmp, Login Data_1.temp.0.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
        Source: TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
        Source: TU1ocSt1kw.exeReversingLabs: Detection: 13%
        Source: TU1ocSt1kw.exeString found in binary or memory: ts but cannot be invoked as functionflag verification failed: password-check not foundhttps://microsoftedge.microsoft.com/addons/detail/crypto/cipher: incorrect nonce length given to GCM %3d | %10d | %13.5f | %13.5f | %13.5f | %13.5f GetFinalPathNameByHandle
        Source: TU1ocSt1kw.exeString found in binary or memory: net/addrselect.go
        Source: TU1ocSt1kw.exeString found in binary or memory: econds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanLi
        Source: TU1ocSt1kw.exeString found in binary or memory: econds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap/unused:bytes/sched/pauses/stopping/gc:seconds/sched/pauses/total/other:secondsmin must be a non-zero power of 2runtime: failed mSpanLi
        Source: TU1ocSt1kw.exeString found in binary or memory: bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=run
        Source: TU1ocSt1kw.exeString found in binary or memory: bytes/sched/pauses/stopping/other:secondsuser arena span is on the wrong listruntime: marked free object in span runtime: unblock on closing polldescruntime: inconsistent write deadlineUnable to determine system directoryruntime: VirtualQuery failed; errno=run
        Source: unknownProcess created: C:\Users\user\Desktop\TU1ocSt1kw.exe "C:\Users\user\Desktop\TU1ocSt1kw.exe"
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeSection loaded: apphelp.dllJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeSection loaded: winmm.dllJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeSection loaded: powrprof.dllJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeSection loaded: umpdc.dllJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeSection loaded: dpapi.dllJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeSection loaded: cryptbase.dllJump to behavior
        Source: TU1ocSt1kw.exeStatic file information: File size 3626496 > 1048576
        Source: TU1ocSt1kw.exeStatic PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x375200
        Source: TU1ocSt1kw.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
        Source: TU1ocSt1kw.exeStatic PE information: section name: UPX2
        Source: initial sampleStatic PE information: section name: UPX0
        Source: initial sampleStatic PE information: section name: UPX1
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
        Source: Web Data_6.temp.0.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
        Source: Web Data_6.temp.0.drBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
        Source: Web Data_6.temp.0.drBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: outlook.office.comVMware20,11696492231s
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: AMC password management pageVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: interactivebrokers.comVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
        Source: Web Data_6.temp.0.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: outlook.office365.comVMware20,11696492231t
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
        Source: Web Data_6.temp.0.drBinary or memory string: discord.comVMware20,11696492231f
        Source: TU1ocSt1kw.exe, 00000000.00000002.1391773485.0000024EF5874000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
        Source: Web Data_6.temp.0.drBinary or memory string: global block list test formVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: dev.azure.comVMware20,11696492231j
        Source: Web Data_6.temp.0.drBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
        Source: Web Data_6.temp.0.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
        Source: Web Data_6.temp.0.drBinary or memory string: bankofamerica.comVMware20,11696492231x
        Source: Web Data_6.temp.0.drBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
        Source: Web Data_6.temp.0.drBinary or memory string: tasks.office.comVMware20,11696492231o
        Source: Web Data_6.temp.0.drBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
        Source: Web Data_6.temp.0.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: ms.portal.azure.comVMware20,11696492231
        Source: Web Data_6.temp.0.drBinary or memory string: turbotax.intuit.comVMware20,11696492231t
        Source: Web Data_6.temp.0.drBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
        Source: Web Data_6.temp.0.drBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
        Source: Web Data_6.temp.0.drBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CommerceHeuristics VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ca VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\cs VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\da VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\el VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en_GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\es_419 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\et VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fil VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\hu VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ko VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lt VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\lv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nb VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ro VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sk VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\th VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\tr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\uk VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\vi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_CN VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\zh_TW VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\TrustTokenKeyCommitments VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\WidevineCdm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ZxcvbnData VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\segmentation_platform VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\attachments VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\BudgetDatabase VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\EntryDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\az VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\be VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bg VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cs VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\cy VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\da VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\el VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es_419 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\et VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fa VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fil VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr_CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\gu VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hu VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\hy VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\is VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\iw VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\km VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kn VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ko VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mn VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\mr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\my VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ne VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\no VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pa VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\pt_PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\si VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sk VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sw VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\te VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\tr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\uk VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ur VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zu VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\JumpListIconsRecentWorkspacesV2 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SegmentInfoDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\wasm\index-dir VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\45553bce-41a3-4fff-adb5-94a1080d3389 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_model_metadata_store VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Fre VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ar VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\de VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\en-GB VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\es VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\fr-CA VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\id VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\it VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ja VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\nl VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-BR VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\pt-PT VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\ru VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\sv VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hans VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-tokenized-card\zh-Hant VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\OriginTrials\0.0.1.4 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\RecoveryImproved VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Speech Recognition\1.15.0.1 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Trust Protection Lists VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231004.1.0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List\2.0.0.4 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WidevineCdm VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0 VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeQueries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes VolumeInformationJump to behavior

        Stealing of Sensitive Information

        barindex
        Yara detected HackBrowser
        Source: Yara matchFile source: 0.2.TU1ocSt1kw.exe.4f0000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: TU1ocSt1kw.exe PID: 5496, type: MEMORYSTR
        Tries to harvest and steal browser information (history, passwords, etc)
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\jsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncmJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dirJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10Jump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web ApplicationsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001Jump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasmJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension SettingsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\TempJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics DatabaseJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dirJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\defJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pingsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download ServiceJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StorageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\eventsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archivedJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code CacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrialsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local StorageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension ScriptsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.defaultJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmiedaJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation PlatformJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.filesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\000003.logJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\EncryptionJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfakJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code CacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\eventsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabaseJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement TrackerJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databasesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.filesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension StateJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\NetworkJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_storeJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENTJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmpJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dirJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_stateJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_dbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dirJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.filesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removedJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\extJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjfJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\LOGJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\CacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackupsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENTJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENTJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App SettingsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\defaultJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibagJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanentJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDBJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\gleanJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldoomlJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67Jump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\dbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\FilesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_dbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session StorageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.filesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareportingJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001Jump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporaryJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001Jump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqliteJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasmJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_dbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.filesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\webappsstore.sqliteJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\SessionsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadataJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\jsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqliteJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\NetworkJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM StoreJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session StorageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pingsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\StorageJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_storeJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.dbJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-releaseJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabaseJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOGJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync DataJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest ResourcesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.filesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension RulesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumpsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_DataJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backupsJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chromeJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashesJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.oldJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOGJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CacheJump to behavior
        Source: C:\Users\user\Desktop\TU1ocSt1kw.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.logJump to behavior

        Remote Access Functionality

        barindex
        Yara detected HackBrowser
        Source: Yara matchFile source: 0.2.TU1ocSt1kw.exe.4f0000.0.unpack, type: UNPACKEDPE
        Source: Yara matchFile source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: TU1ocSt1kw.exe PID: 5496, type: MEMORYSTR

        Mitre Att&ck Matrix

        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
        Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
        Command and Scripting Interpreter        		1
        DLL Side-Loading        		1
        Process Injection        		1
        Masquerading        		1
        OS Credential Dumping        		1
        Security Software Discovery        		Remote Services1
        Data from Local System        		1
        Non-Application Layer Protocol        		Exfiltration Over Other Network MediumAbuse Accessibility Features
        CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
        DLL Side-Loading        		1
        Software Packing        		LSASS Memory11
        System Information Discovery        		Remote Desktop ProtocolData from Removable Media1
        Application Layer Protocol        		Exfiltration Over BluetoothNetwork Denial of Service
        Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
        Process Injection        		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
        Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
        DLL Side-Loading        		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
        Obfuscated Files or Information        		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        TU1ocSt1kw.exe13%ReversingLabsWin64.Malware.Generic
        TU1ocSt1kw.exe100%Joe Sandbox ML

        Dropped Files

        ⊘No Antivirus matches

        Unpacked PE Files

        ⊘No Antivirus matches

        Domains

        ⊘No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        https://duckduckgo.com/chrome_newtab0%URL Reputationsafe
        https://duckduckgo.com/ac/?q=0%URL Reputationsafe
        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=0%URL Reputationsafe
        https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=0%URL Reputationsafe
        https://www.ecosia.org/newtab/0%URL Reputationsafe
        https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br0%URL Reputationsafe
        https://ac.ecosia.org/autocomplete?q=0%URL Reputationsafe
        https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search0%URL Reputationsafe
        https://support.mozilla.org0%URL Reputationsafe
        https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=0%URL Reputationsafe

        Domains and IPs

        Contacted Domains

        NameIPActiveMaliciousAntivirus DetectionReputation
        time.windows.com
        		unknown
        		unknownfalse
          		unknown

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://file://mailto:http://BINARY-x0X03.46.0TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpfalse
            		unknown
            https://duckduckgo.com/chrome_newtabTU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            https://github.com/moonD4rk/HackBrowserDataTU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpfalse
              		unknown
              https://github.com/urfave/cli/blob/main/docs/CHANGELOG.mdsync:TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpfalse
                		unknown
                https://duckduckgo.com/ac/?q=TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureC:TU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmpfalse
                  		unknown
                  https://www.google.com/images/branding/product/ico/googleg_lodp.icoTU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                    		unknown
                    https://drive-daily-2.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                      		unknown
                      https://drive-autopush.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                        		unknown
                        https://drive-daily-4.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                          		unknown
                          https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://www.ecosia.org/newtab/TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://drive-daily-1.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                            		unknown
                            https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brplaces.sqlite_17.temp.0.drfalse
                            • URL Reputation: safe
                            		unknown
                            https://drive-daily-5.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                              		unknown
                              https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhieTU1ocSt1kw.exe, 00000000.00000003.1382016505.000000C0000C6000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388370296.000000C0000C8000.00000004.00001000.00020000.00000000.sdmpfalse
                                		unknown
                                https://docs.google.com/TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		unknown
                                  https://ac.ecosia.org/autocomplete?q=TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                                  • URL Reputation: safe
                                  		unknown
                                  https://drive-staging.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                    		unknown
                                    https://drive-daily-6.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                      		unknown
                                      https://drive.google.com/TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                        		unknown
                                        https://drive-daily-0.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		unknown
                                          https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchTU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhiTU1ocSt1kw.exe, 00000000.00000003.1382129067.000000C00008A000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1382168430.000000C000086000.00000004.00001000.00020000.00000000.sdmp, microsoft_edge_default_extension.csv.0.drfalse
                                            		unknown
                                            https://chrome.google.com/webstore/detail/crypto/sha1:TU1ocSt1kw.exe, TU1ocSt1kw.exe, 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmpfalse
                                              		unknown
                                              https://github.com/urfave/cli/blob/main/docs/CHANGELOG.md#deprecated-cli-app-action-signatureTU1ocSt1kw.exe, 00000000.00000002.1389013901.000000C00017E000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1386894833.000000C000056000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000003.1381636425.000000C00017E000.00000004.00001000.00020000.00000000.sdmpfalse
                                                		unknown
                                                https://drive-preprod.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  https://support.mozilla.orgplaces.sqlite_17.temp.0.drfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=TU1ocSt1kw.exe, 00000000.00000003.1376322229.000000C000404000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLKplaces.sqlite_17.temp.0.drfalse
                                                    		unknown
                                                    https://drive-daily-3.corp.google.com/TU1ocSt1kw.exe, 00000000.00000003.1382059433.000000C0000AE000.00000004.00001000.00020000.00000000.sdmp, TU1ocSt1kw.exe, 00000000.00000002.1388297883.000000C0000AE000.00000004.00001000.00020000.00000000.sdmpfalse
                                                      		unknown

                                                      World Map of Contacted IPs

                                                      ⊘No contacted IP infos

                                                      General Information

                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1537102
                                                      Start date and time:2024-10-18 15:12:05 +02:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 3m 17s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                      Number of analysed new started processes analysed:4
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:0
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Sample name:TU1ocSt1kw.exe
                                                      renamed because original name is a hash value
                                                      Original Sample Name:89f65ad79caa39d402fc618dd3a49148.exe
                                                      Detection:MAL
                                                      Classification:mal68.troj.spyw.winEXE@2/39@2/0
                                                      EGA Information:Failed
                                                      HCA Information:Failed
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe
                                                      • Stop behavior analysis, all processes terminated

                                                      Warnings

                                                      • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
                                                      • Excluded IPs from analysis (whitelisted): 20.101.57.9, 13.95.65.251
                                                      • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, twc.trafficmanager.net
                                                      • Execution Graph export aborted for target TU1ocSt1kw.exe, PID 5496 because it is empty
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • VT rate limit hit for: TU1ocSt1kw.exe

                                                      Simulations

                                                      Behavior and APIs

                                                      ⊘No simulations

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      ⊘No context

                                                      Domains

                                                      ⊘No context

                                                      ASNs

                                                      ⊘No context

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      C:\Users\user~1\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT (copy)

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Qv:1qIFQv
                                                      MD5:9F36605EFBA98DAB15728FE8B5538AA0
                                                      SHA1:6A7CFF514AE159A59B70F27DDE52A3A5DD01B1C8
                                                      SHA-256:9C283F6E81028B9EB0760D918EE4BC0AA256ED3B926393C1734C760C4BD724FD
                                                      SHA-512:1893AA3D1ABCF7F9E83911468FA2EEB2AD1D7E23F4586BD6C4D76F9F96A645C15E63E44DA55700347165E97B6AC412E6D495B81C3DA9FAA61D617C7A71A7404C
                                                      Malicious:false
                                                      Reputation:moderate, very likely benign file
                                                      Preview:MANIFEST-000005.

                                                      C:\Users\user~1\AppData\Local\Temp\Session Storage_8.temp\CURRENT (copy)

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Tv:1qIFj
                                                      MD5:AEFD77F47FB84FAE5EA194496B44C67A
                                                      SHA1:DCFBB6A5B8D05662C4858664F81693BB7F803B82
                                                      SHA-256:4166BF17B2DA789B0D0CC5C74203041D98005F5D4EF88C27E8281E00148CD611
                                                      SHA-512:B733D502138821948267A8B27401D7C0751E590E1298FDA1428E663CCD02F55D0D2446FF4BC265BDCDC61F952D13C01524A5341BC86AFC3C2CDE1D8589B2E1C3
                                                      Malicious:false
                                                      Reputation:high, very likely benign file
                                                      Preview:MANIFEST-000006.

                                                      C:\Users\user\AppData\Local\Temp\Cookies_2.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                      Category:dropped
                                                      Size (bytes):20480
                                                      Entropy (8bit):0.6732424250451717
                                                      Encrypted:false
                                                      SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                      MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                      SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                      SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                      SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                      Malicious:false
                                                      Reputation:high, very likely benign file
                                                      Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\History_4.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                      Category:dropped
                                                      Size (bytes):155648
                                                      Entropy (8bit):0.5407252242845243
                                                      Encrypted:false
                                                      SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                      MD5:7B955D976803304F2C0505431A0CF1CF
                                                      SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                      SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                      SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                      Malicious:false
                                                      Reputation:high, very likely benign file
                                                      Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\History_5.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                      Category:dropped
                                                      Size (bytes):155648
                                                      Entropy (8bit):0.5407252242845243
                                                      Encrypted:false
                                                      SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                      MD5:7B955D976803304F2C0505431A0CF1CF
                                                      SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                      SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                      SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\Local State_0.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:JSON data
                                                      Category:dropped
                                                      Size (bytes):56065
                                                      Entropy (8bit):6.103092433941306
                                                      Encrypted:false
                                                      SSDEEP:1536:z/Ps+wsI7ynTPGWv/sxtwx7VLyMV/YoskFoQ:z/0+zI7ynLv/4KJVeZoskx
                                                      MD5:35E04408556B5F409774D2CF2BD07814
                                                      SHA1:A1131C0B9C944E455A11625C9812631ACBB2580D
                                                      SHA-256:E18519773390D2BD33BEC9CDDA152B64D84575411132E4FA316A1D07DD253F2D
                                                      SHA-512:3D5F8F0884AA4ADBE7B060C1266B3019DDA84E5D0AD3DC902FDA9BECE901C9E298E974337BB63DA43E5824482A89B9850F373C86E017D7D7374ACA39F43B5282
                                                      Malicious:false
                                                      Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                      Malicious:false
                                                      Preview:MANIFEST-000001.

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.5

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Qv:1qIFQv
                                                      MD5:9F36605EFBA98DAB15728FE8B5538AA0
                                                      SHA1:6A7CFF514AE159A59B70F27DDE52A3A5DD01B1C8
                                                      SHA-256:9C283F6E81028B9EB0760D918EE4BC0AA256ED3B926393C1734C760C4BD724FD
                                                      SHA-512:1893AA3D1ABCF7F9E83911468FA2EEB2AD1D7E23F4586BD6C4D76F9F96A645C15E63E44DA55700347165E97B6AC412E6D495B81C3DA9FAA61D617C7A71A7404C
                                                      Malicious:false
                                                      Preview:MANIFEST-000005.

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\CURRENT.bak

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                      Malicious:false
                                                      Preview:MANIFEST-000001.

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\LOG

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:Unicode text, UTF-8 text
                                                      Category:dropped
                                                      Size (bytes):902
                                                      Entropy (8bit):5.467726349508536
                                                      Encrypted:false
                                                      SSDEEP:12:kuSH34vLZYeb8EFUtjD/xr54ZYeb8bib2iaFhJ2XhdMuHtmdfjMuHJRzQD:5SH3KlYeb88gjV9oYeb8eDaAEx6
                                                      MD5:44CF25FE3760805DC587CADAE3A5ADFE
                                                      SHA1:D63EA01E60DB6310D5F9D8A85E3A6F1A9F4CCB04
                                                      SHA-256:BDC68392A5BA2DC40D2BB48018C6CB50F2C02108421BA542350B86BC2FD3087E
                                                      SHA-512:33CA109A4261641D0AB547B8374D00FCA4DD6D89516E1BBA4E5421F6A0FCA3FBE09A492224D7D48D48CF18A4E14EF7C7B8842364F898BD26035A2DBB69BC31CC
                                                      Malicious:false
                                                      Preview:2023/10/05-08:53:13.528 158 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2023/10/05-08:53:13.529 158 Recovering log #3.2023/10/05-08:53:13.530 158 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .=============== Oct 18, 2024 (EDT) ===============.09:13:11.403245 log@legend F.NumFile S.FileSize N.Entry C.BadEntry B.BadBlock Ke.KeyError D.DroppedEntry L.Level Q.SeqNum T.TimeElapsed.09:13:11.403245 version@stat F.[] S.0B[] Sc.[].09:13:11.403245 db@open opening.09:13:11.403245 journal@recovery F.1.09:13:11.497932 journal@recovery recovering @3.09:13:11.497932 version@stat F.[] S.0B[] Sc.[].09:13:11.518520 db@janitor F.2 G.0.09:13:11.518520 db@open done T.115.2757ms.09:13:11.518520 db@close closing.09:13:11.518520 db@close done T.0s.

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\LOG.old

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):342
                                                      Entropy (8bit):5.184931147495079
                                                      Encrypted:false
                                                      SSDEEP:6:ku8vIq2PcNwi23oH+Tcwt8a2jMGIFUtjWgZmwx+FzkwOcNwi23oH+Tcwt8a2jMmd:kusIvLZYeb8EFUtjd/x6z54ZYeb8bJ
                                                      MD5:C7DD0E003D79550803C76E5E9F7320B0
                                                      SHA1:2B4B85016FC808769E6EA4A8D6DA43F0284DF3FD
                                                      SHA-256:AC4B1ADB6F6B2B2794BC3CCEB88F60365478E995225B42FDCBB406D6882DF126
                                                      SHA-512:7AE13546660185AF423D39317EA1B078BB838F0FB018C4483C641C2F401DC6519727C9A6A30BBB70C07B03A54DB277BD779D0EF82FD491825058F9361F75D2CF
                                                      Malicious:false
                                                      Preview:2023/10/05-08:51:23.395 1790 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2023/10/05-08:51:23.396 1790 Recovering log #3.2023/10/05-08:51:23.397 1790 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000001

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:OpenPGP Secret Key
                                                      Category:dropped
                                                      Size (bytes):41
                                                      Entropy (8bit):4.704993772857998
                                                      Encrypted:false
                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                      Malicious:false
                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                      C:\Users\user\AppData\Local\Temp\Local Storage\leveldb_7.temp\MANIFEST-000005

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):41
                                                      Entropy (8bit):4.772186150959546
                                                      Encrypted:false
                                                      SSDEEP:3:At/OIxQRDKIVRln:S/O7Dn
                                                      MD5:EACDD7DE767B7664FAE36AC76F46650E
                                                      SHA1:B3BFE4D7CD7CB7DBF8DB57345CCB2341FEDEFBDB
                                                      SHA-256:5F53C3A8000D02EF8705A6D15E0D237C389A7189106FD954D9B4B7E5D1763360
                                                      SHA-512:FBA8532A6324EFB7D73C50F782D9E749D5F7F5F0E12222E3B2DD3307398215A13D9052C586AD04760E509421C52C7B3C287617DD55DDC8CC5537708644E6A6B0
                                                      Malicious:false
                                                      Preview:cW."....leveldb.BytewiseComparator......

                                                      C:\Users\user\AppData\Local\Temp\Login Data_1.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                      Category:dropped
                                                      Size (bytes):51200
                                                      Entropy (8bit):0.8746135976761988
                                                      Encrypted:false
                                                      SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                      MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                      SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                      SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                      SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\Secure Preferences_9.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:JSON data
                                                      Category:dropped
                                                      Size (bytes):30076
                                                      Entropy (8bit):5.567970480422815
                                                      Encrypted:false
                                                      SSDEEP:768:s1bnxrLoL6PaWPQqfIi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXUKwKh0rwHD7K4:s1bnxfW6PaWPQqfIiu1ja+UK9htfl
                                                      MD5:CA22DD8690ED12578E1F5C991E5C8CB2
                                                      SHA1:DE811C29601C1F23AE93308071473E7BBA12926E
                                                      SHA-256:F7BE9DC8DAB56562753A0FCBC3DBDBCE9101346FCF8F7CE8288257A3EF4755BC
                                                      SHA-512:DFE252C2C96065AF9AC95E6585F45CFA6EE9853D00FBB3190C01239023748970ACAAFC61923EB5B9E68D1EB9EF61C54521BC5860D6F46442362B0CF7CCA8713B
                                                      Malicious:false
                                                      Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13340965216287756","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13340965216287756","location":5,"ma

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\000003.log

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):61
                                                      Entropy (8bit):3.7273991737283296
                                                      Encrypted:false
                                                      SSDEEP:3:S8ltHlS+QUl1ASEGhTFl:S85aEFl
                                                      MD5:9F7EADC15E13D0608B4E4D590499AE2E
                                                      SHA1:AFB27F5C20B117031328E12DD3111A7681FF8DB5
                                                      SHA-256:5C3A5B578AB9FE853EAD7040BC161929EA4F6902073BA2B8BB84487622B98923
                                                      SHA-512:88455784C705F565C70FA0A549C54E2492976E14643E9DD0A8E58C560D003914313DF483F096BD33EC718AEEC7667B8DE063A73627AA3436BA6E7E562E565B3F
                                                      Malicious:false
                                                      Preview:*...#................version.1..namespace-..&f...............

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\000004.ldb

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:TeX font metric data
                                                      Category:dropped
                                                      Size (bytes):141
                                                      Entropy (8bit):3.6926186394152882
                                                      Encrypted:false
                                                      SSDEEP:3:7EGGkIWMxEtukW8Utesj6lF7AQ/H//lr7:AYTa8TsenAQX/lH
                                                      MD5:800964100BF5522029908E4D62C8CB86
                                                      SHA1:28FA46CA8B867B24975FFA2E164A08DCB8C3838D
                                                      SHA-256:4320E36C155668FAF70DF6378ED4748E176A45F9B38996F5529FB8DBAF7A46BE
                                                      SHA-512:511D001B6A05F93F113924A60CF225D03811527A2FE915B25C0305FE64F8DFC8600AE67EBE51246852EB11EA063621801C4E028292626F49DDD989EF0B245936
                                                      Malicious:false
                                                      Preview:0<...namespace-.....d..version........1.........Y.E............4.......w....$./.............4.C.....................................W...$uG.

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                      Malicious:false
                                                      Preview:MANIFEST-000001.

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT.5

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Qv:1qIFQv
                                                      MD5:9F36605EFBA98DAB15728FE8B5538AA0
                                                      SHA1:6A7CFF514AE159A59B70F27DDE52A3A5DD01B1C8
                                                      SHA-256:9C283F6E81028B9EB0760D918EE4BC0AA256ED3B926393C1734C760C4BD724FD
                                                      SHA-512:1893AA3D1ABCF7F9E83911468FA2EEB2AD1D7E23F4586BD6C4D76F9F96A645C15E63E44DA55700347165E97B6AC412E6D495B81C3DA9FAA61D617C7A71A7404C
                                                      Malicious:false
                                                      Preview:MANIFEST-000005.

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT.6

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Tv:1qIFj
                                                      MD5:AEFD77F47FB84FAE5EA194496B44C67A
                                                      SHA1:DCFBB6A5B8D05662C4858664F81693BB7F803B82
                                                      SHA-256:4166BF17B2DA789B0D0CC5C74203041D98005F5D4EF88C27E8281E00148CD611
                                                      SHA-512:B733D502138821948267A8B27401D7C0751E590E1298FDA1428E663CCD02F55D0D2446FF4BC265BDCDC61F952D13C01524A5341BC86AFC3C2CDE1D8589B2E1C3
                                                      Malicious:false
                                                      Preview:MANIFEST-000006.

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):16
                                                      Entropy (8bit):3.2743974703476995
                                                      Encrypted:false
                                                      SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                      MD5:46295CAC801E5D4857D09837238A6394
                                                      SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                      SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                      SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                      Malicious:false
                                                      Preview:MANIFEST-000001.

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\LOG

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:Unicode text, UTF-8 text
                                                      Category:dropped
                                                      Size (bytes):1046
                                                      Entropy (8bit):5.537268211783586
                                                      Encrypted:false
                                                      SSDEEP:12:kuXZYebvqB6Lx39VF34vLZYebvqBZFUyyb2iaFhJ2XhsjMuHWzhrmPDvbkhydygP:5pYebvbLxnMlYebvyZqDaA0vRdaGr
                                                      MD5:5134536E2879B3F56B9B317B8308323C
                                                      SHA1:2FEAC35970537B5E977D97C9447C975DCA66CBCF
                                                      SHA-256:95C8609E05088EE417D931C2ED35BC1AAB10D3FCDAE4660B60EE16956C3B3B4F
                                                      SHA-512:8763061D501DDC8EA45FF4A0B95F44E97E2E19A7B0746F7113B18084060E3601F9914255905A79E53381479DE9D70FA3E4C628B268CE8E0528BFCBFF22D30BB3
                                                      Malicious:false
                                                      Preview:2023/10/05-08:40:32.474 910 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage since it was missing..2023/10/05-08:40:32.500 910 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.=============== Oct 18, 2024 (EDT) ===============.09:13:11.538700 log@legend F.NumFile S.FileSize N.Entry C.BadEntry B.BadBlock Ke.KeyError D.DroppedEntry L.Level Q.SeqNum T.TimeElapsed.09:13:11.538700 version@stat F.[] S.0B[] Sc.[].09:13:11.538700 db@open opening.09:13:11.554304 journal@recovery F.1.09:13:11.554304 journal@recovery recovering @3.09:13:11.554304 memdb@flush created L0@4 N.2 S.141B "nam..ce-,d2":"version,v1".09:13:11.554304 version@stat F.[1] S.141B[141B] Sc.[0.25].09:13:11.554304 db@janitor F.3 G.0.09:13:11.554304 db@open done T.15.6045ms.09:13:11.554304 db@close closi

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\LOG.old

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:ASCII text
                                                      Category:dropped
                                                      Size (bytes):328
                                                      Entropy (8bit):5.213921765183054
                                                      Encrypted:false
                                                      SSDEEP:6:kuM2+q2PcNwi23iKKdKrQMxIFUtjM3ZmwxMo3VkwOcNwi23iKKdKrQMFLJ:kuM3vLZ5KkCFUtjM3/xMoF54Z5KktJ
                                                      MD5:91E8A6F2463AEDA2BF0C6FE22B692A06
                                                      SHA1:0A68B9F005541E31EDFC1150F183B4E7BE19311F
                                                      SHA-256:53607FF4C92044441DD6FDE498DE12057043DA81E0329D8F1812EA383068960D
                                                      SHA-512:EDD7982555EB65972026C64D2E7F31135183599C4F3693EAC48A166D38A1B4E967DA6732F910B8679A8DF2FC705A6765617B2BFD73BE8F478E8D0BC38B320FC3
                                                      Malicious:false
                                                      Preview:2023/10/05-08:41:55.573 1b78 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/MANIFEST-000001.2023/10/05-08:41:55.574 1b78 Recovering log #3.2023/10/05-08:41:55.575 1b78 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage/000003.log .

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:OpenPGP Secret Key
                                                      Category:dropped
                                                      Size (bytes):41
                                                      Entropy (8bit):4.704993772857998
                                                      Encrypted:false
                                                      SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                      MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                      SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                      SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                      SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                      Malicious:false
                                                      Preview:.|.."....leveldb.BytewiseComparator......

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000005

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):41
                                                      Entropy (8bit):4.772186150959546
                                                      Encrypted:false
                                                      SSDEEP:3:At/OIxQRDKIVRln:S/O7Dn
                                                      MD5:EACDD7DE767B7664FAE36AC76F46650E
                                                      SHA1:B3BFE4D7CD7CB7DBF8DB57345CCB2341FEDEFBDB
                                                      SHA-256:5F53C3A8000D02EF8705A6D15E0D237C389A7189106FD954D9B4B7E5D1763360
                                                      SHA-512:FBA8532A6324EFB7D73C50F782D9E749D5F7F5F0E12222E3B2DD3307398215A13D9052C586AD04760E509421C52C7B3C287617DD55DDC8CC5537708644E6A6B0
                                                      Malicious:false
                                                      Preview:cW."....leveldb.BytewiseComparator......

                                                      C:\Users\user\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000006

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):121
                                                      Entropy (8bit):4.422053334167835
                                                      Encrypted:false
                                                      SSDEEP:3:Pt/JJxQRDKIVvwGhpw0uGPllddEtcw0uGPllddEtl:jY7v3uqlK8uqlKl
                                                      MD5:3FBD42704B3E54B1FCB9F37E4656D34D
                                                      SHA1:40EFC18C07B4714C58D512AAAE3369CDB4B63598
                                                      SHA-256:76816EA4B1D419811B52D7571F24C7DA87A8832A475A1D3CA64931488A37BCA3
                                                      SHA-512:36C35F054431CAAB8CDC2B1AC3DE0B851CC0D5429FDB0BCF7F8AC1BB5625D597A148276EC237F79738AD97340168D54A76A99D26269224959F521A60782052B5
                                                      Malicious:false
                                                      Preview:f.N.r....leveldb.BytewiseComparator............namespace-.........version..............namespace-.........version........

                                                      C:\Users\user\AppData\Local\Temp\Web Data_6.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                      Category:dropped
                                                      Size (bytes):196608
                                                      Entropy (8bit):1.1215420383712111
                                                      Encrypted:false
                                                      SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                      MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                      SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                      SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                      SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\cookies.sqlite_14.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                      Category:dropped
                                                      Size (bytes):98304
                                                      Entropy (8bit):0.08235737944063153
                                                      Encrypted:false
                                                      SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                      MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                      SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                      SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                      SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\extensions.json_21.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:JSON data
                                                      Category:modified
                                                      Size (bytes):36830
                                                      Entropy (8bit):5.186376962556299
                                                      Encrypted:false
                                                      SSDEEP:768:NI40vfXXQ4z6X4n44a4T4h4b4rhEhvj4Lw4m4x44g:NJhWvx
                                                      MD5:C2A8F76D683C9F86054CA7775732A180
                                                      SHA1:FB1F8B84825D53E58290E53D65F8A73C5794E281
                                                      SHA-256:4744AACB03666A594CF1BB6E6491105F0AB600259D8E0BA483164F2AE9C90221
                                                      SHA-512:F804B8CF7277D2F6E8AA8BDFFF099ECCEC00CE59FEB3F3EB47D5E4B36FBB2C23466233C966F53483F0DF365E13AB9BB9256B685645FC366A5A24C72907E54025
                                                      Malicious:false
                                                      Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{9f54712e-79e2-445b-974a-266a0185f206}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                      C:\Users\user\AppData\Local\Temp\key4.db_12.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
                                                      Category:dropped
                                                      Size (bytes):294912
                                                      Entropy (8bit):0.08441928760034874
                                                      Encrypted:false
                                                      SSDEEP:192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:51zkVmvQhyn+Zoz67V
                                                      MD5:2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D
                                                      SHA1:14DFBE9B28D033542357D98005239D842A16FCFD
                                                      SHA-256:91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
                                                      SHA-512:DD4BD1407DFDC90BC97F5940A120CCDE7D4A6DAA3E0DB1649BED96EBE52FFDF879E52E028657F954FF39A93EEE8F57694A7EAC55D85CA57AF2BBD7A7793B9030
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\places.sqlite_15.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                      Category:dropped
                                                      Size (bytes):5242880
                                                      Entropy (8bit):0.03786218306281921
                                                      Encrypted:false
                                                      SSDEEP:192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
                                                      MD5:4BB4A37B8E93E9B0F5D3DF275799D45E
                                                      SHA1:E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
                                                      SHA-256:89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
                                                      SHA-512:F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\places.sqlite_16.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                      Category:dropped
                                                      Size (bytes):5242880
                                                      Entropy (8bit):0.03786218306281921
                                                      Encrypted:false
                                                      SSDEEP:192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
                                                      MD5:4BB4A37B8E93E9B0F5D3DF275799D45E
                                                      SHA1:E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
                                                      SHA-256:89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
                                                      SHA-512:F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\places.sqlite_17.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                      Category:dropped
                                                      Size (bytes):5242880
                                                      Entropy (8bit):0.03786218306281921
                                                      Encrypted:false
                                                      SSDEEP:192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
                                                      MD5:4BB4A37B8E93E9B0F5D3DF275799D45E
                                                      SHA1:E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
                                                      SHA-256:89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
                                                      SHA-512:F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\AppData\Local\Temp\webappsstore.sqlite_19.temp

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:SQLite 3.x database, user version 2, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 2
                                                      Category:dropped
                                                      Size (bytes):98304
                                                      Entropy (8bit):0.048631947703368275
                                                      Encrypted:false
                                                      SSDEEP:6:ltTMK/E7R/Wwhm914iDKrvcwTlNCcVWDeNgLu5e3cwOJrheFDEf:DIaE7Rzhm9GiD0c4NCcVUo58cz16D
                                                      MD5:72BCFF6B14E4D56701817BDC948967AA
                                                      SHA1:8BB20201B2162FEFF149BA0281426FA1A67697C4
                                                      SHA-256:741EE4D7724BEF132AA68BE667DDD8CB462A2DB886156280113018B4FB774ACD
                                                      SHA-512:9FDDE0C525D70B3792FF35F63040B7B6579EB5DE064A67A532C90886D0589ABDFA9245A7A6A39C110E6530D3333CF1E608EAAC18D41D89BAC1771A3D75E2E199
                                                      Malicious:false
                                                      Preview:SQLite format 3......@ ..........................................................................j......~...r~.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Users\user\Desktop\results\chrome_default_cookie.csv

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:CSV text
                                                      Category:dropped
                                                      Size (bytes):494
                                                      Entropy (8bit):5.6558029414845326
                                                      Encrypted:false
                                                      SSDEEP:12:JbwWo4mg807Tva3UhyL/8ObWi+e/WvcllP757f:JU0mZyG3wycipeUN7f
                                                      MD5:C4CE27103DA2C69B363EFB04D2BD8FE6
                                                      SHA1:9D2B24B68FB5892873558BE8A6AB01D8FE977517
                                                      SHA-256:634282F0EE15CC081D610E28B2C7B6557CAE5EAC723D91DA9A76C21EC315C0C4
                                                      SHA-512:B5443879BF72ABEDE1669AE1329570BE5FDE6972D1524088E71066F1CDABE9780CCECAB756FDB1AC0B5E878EFFB767D0B43B4FFAF85C91E645DCB105A9962701
                                                      Malicious:false
                                                      Preview:.Host,Path,KeyName,Value,IsSecure,IsHTTPOnly,HasExpire,IsPersistent,CreateDate,ExpireDate..google.com,/,NID,511=nNadqW9uTcY0OP6I3afnr71o6EzaYLsdpW4UEYN3vYq_rbRrNFxM1jozPGuhjORBZKKMz2tdDpVe7dNuTWp4CyK-zt5Is6wVElveWAfKQgwNJiKKtXHCCCmrlgzZTl5CiKjTeA2iQqf6zlRK2h8wg1hVpIsWsaKqaWJyHMPF3JA,true,true,true,true,2023-10-05T08:42:21.976533-04:00,2024-04-05T08:42:20.976533-04:00..google.com,/,1P_JAR,2023-10-05-07,true,false,true,true,2023-10-05T08:42:21.793259-04:00,2023-11-04T08:42:21.976489-04:00.

                                                      C:\Users\user\Desktop\results\chrome_default_sessionstorage.csv

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                      Category:dropped
                                                      Size (bytes):34
                                                      Entropy (8bit):4.0796786498829745
                                                      Encrypted:false
                                                      SSDEEP:3:agq+U5Ewv:ag0
                                                      MD5:D07886F7107C50304E1B9CDE0793ED04
                                                      SHA1:41453A6E9DB25A06B4EF031C12FDCEE8A3818741
                                                      SHA-256:963B596F0385F5BE1B8AD2F7E5B4FF474AEB1A1A8D17D20FF67A1CD30CA70344
                                                      SHA-512:A917504C89A8EC7B8FC5D89A683FCE01CE45A160DBB98861CC2432C221A2F3E7ACA15B7325967C171E2DE2D7CE26FFA01ECEF49C7B896B1A16DAA5A3125EB4CA
                                                      Malicious:false
                                                      Preview:.IsMeta,URL,Key,Value.false,,,1.

                                                      C:\Users\user\Desktop\results\microsoft_edge_def_sessionstorage.csv

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                      Category:dropped
                                                      Size (bytes):34
                                                      Entropy (8bit):4.0796786498829745
                                                      Encrypted:false
                                                      SSDEEP:3:agq+U5Ewv:ag0
                                                      MD5:D07886F7107C50304E1B9CDE0793ED04
                                                      SHA1:41453A6E9DB25A06B4EF031C12FDCEE8A3818741
                                                      SHA-256:963B596F0385F5BE1B8AD2F7E5B4FF474AEB1A1A8D17D20FF67A1CD30CA70344
                                                      SHA-512:A917504C89A8EC7B8FC5D89A683FCE01CE45A160DBB98861CC2432C221A2F3E7ACA15B7325967C171E2DE2D7CE26FFA01ECEF49C7B896B1A16DAA5A3125EB4CA
                                                      Malicious:false
                                                      Preview:.IsMeta,URL,Key,Value.false,,,1.

                                                      C:\Users\user\Desktop\results\microsoft_edge_default_extension.csv

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                      Category:dropped
                                                      Size (bytes):301
                                                      Entropy (8bit):4.8896916339079635
                                                      Encrypted:false
                                                      SSDEEP:6:2oEIAAoF+Ku7WfIa9c01RnKKu0tJk3KpHZIUvJ/msJsqYAtUH:BEITX7YIccoFKXYk6plvOgqH
                                                      MD5:37C3615B27EF78CFF8F32152D06BA44D
                                                      SHA1:038B34850087E3A7B8C39779DC3C9DF1E263B28C
                                                      SHA-256:25D98741BB87553607C471C6DC30614CABCFFFEEF074D1A3562DB98BCB198A82
                                                      SHA-512:0DA8403EA2C5C5E4EF335F941A6D9D98D8A6EE4B9FCD6B06EFB4C970C1E0B472F2B43DD3670569C46AE90F8797B660DEF0EDF8C272DBF51BDFDC6C62D58479FC
                                                      Malicious:false
                                                      Preview:.ID,URL,Enabled,Name,Description,Version,HomepageURL.ghbmnnjooekpmoecnnnilnnbdlolhkhi,https://chrome.google.com/webstore/detail/ghbmnnjooekpmoecnnnilnnbdlolhkhi,false,Google Docs Offline,"Edit, create and view your documents, spreadsheets and presentations . all without Internet access.",1.66.0,.

                                                      C:\Users\user\Desktop\results\microsoft_edge_default_sessionstorage.csv

                                                      Download File
                                                      Process:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      File Type:Unicode text, UTF-8 (with BOM) text
                                                      Category:dropped
                                                      Size (bytes):34
                                                      Entropy (8bit):4.0796786498829745
                                                      Encrypted:false
                                                      SSDEEP:3:agq+U5Ewv:ag0
                                                      MD5:D07886F7107C50304E1B9CDE0793ED04
                                                      SHA1:41453A6E9DB25A06B4EF031C12FDCEE8A3818741
                                                      SHA-256:963B596F0385F5BE1B8AD2F7E5B4FF474AEB1A1A8D17D20FF67A1CD30CA70344
                                                      SHA-512:A917504C89A8EC7B8FC5D89A683FCE01CE45A160DBB98861CC2432C221A2F3E7ACA15B7325967C171E2DE2D7CE26FFA01ECEF49C7B896B1A16DAA5A3125EB4CA
                                                      Malicious:false
                                                      Preview:.IsMeta,URL,Key,Value.false,,,1.

                                                      Static File Info

                                                      General

                                                      File type:PE32+ executable (console) x86-64, for MS Windows
                                                      Entropy (8bit):7.923830266712944
                                                      TrID:
                                                      • Win64 Executable Console (202006/5) 81.26%
                                                      • UPX compressed Win32 Executable (30571/9) 12.30%
                                                      • Win64 Executable (generic) (12005/4) 4.83%
                                                      • Generic Win/DOS Executable (2004/3) 0.81%
                                                      • DOS Executable Generic (2002/1) 0.81%
                                                      File name:TU1ocSt1kw.exe
                                                      File size:3'626'496 bytes
                                                      MD5:89f65ad79caa39d402fc618dd3a49148
                                                      SHA1:3813282fab620579a437e3ca4f290fd41ef26f82
                                                      SHA256:7ec7ffec1926a1f945e328f7ca9561d2b3bd30d6b4078b4a5da5d2111d9d6636
                                                      SHA512:1acdef4ff4e2cefddcda05fbd91d0e91fbcb782b9491cbb76724aeeea507b8510c27a89ceac941616afa569c721a1f5d4d393964b028b8342356c6e3b2fd5a52
                                                      SSDEEP:49152:WqGZQ32yVtPaKzUn0xKWSWoJpHVtnDzNg33PNUZp94CE0FWAV1eOi:Wq/WKzUn0kWSDLnK3Gpw0Fref
                                                      TLSH:C0F53313137751DEE2BEF1B486328159B24F6C4844DF2F85AC8806EB7ABFF689484E15
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................."......`7.......h..n... h...@...........................................`... ............................

                                                      File Icon

                                                      Icon Hash:00928e8e8686b000

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0xdf6ea0
                                                      Entrypoint Section:UPX1
                                                      Digitally signed:false
                                                      Imagebase:0x400000
                                                      Subsystem:windows cui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x0 [Thu Jan 1 00:00:00 1970 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:6
                                                      OS Version Minor:1
                                                      File Version Major:6
                                                      File Version Minor:1
                                                      Subsystem Version Major:6
                                                      Subsystem Version Minor:1
                                                      Import Hash:6ed4f5f04d62b18d96b26d6db7c18840

                                                      Entrypoint Preview

                                                      Instruction
                                                      push ebx
                                                      push esi
                                                      push edi
                                                      push ebp
                                                      dec eax
                                                      lea esi, dword ptr [FFC8B17Ah]
                                                      dec eax
                                                      lea edi, dword ptr [esi-00681025h]
                                                      push edi
                                                      xor ebx, ebx
                                                      xor ecx, ecx
                                                      dec eax
                                                      or ebp, FFFFFFFFh
                                                      call 00007F0910FBA905h
                                                      add ebx, ebx
                                                      je 00007F0910FBA8B4h
                                                      rep ret
                                                      mov ebx, dword ptr [esi]
                                                      dec eax
                                                      sub esi, FFFFFFFCh
                                                      adc ebx, ebx
                                                      mov dl, byte ptr [esi]
                                                      rep ret
                                                      dec eax
                                                      lea eax, dword ptr [edi+ebp]
                                                      cmp ecx, 05h
                                                      mov dl, byte ptr [eax]
                                                      jbe 00007F0910FBA8D3h
                                                      dec eax
                                                      cmp ebp, FFFFFFFCh
                                                      jnbe 00007F0910FBA8CDh
                                                      sub ecx, 04h
                                                      mov edx, dword ptr [eax]
                                                      dec eax
                                                      add eax, 04h
                                                      sub ecx, 04h
                                                      mov dword ptr [edi], edx
                                                      dec eax
                                                      lea edi, dword ptr [edi+04h]
                                                      jnc 00007F0910FBA8A1h
                                                      add ecx, 04h
                                                      mov dl, byte ptr [eax]
                                                      je 00007F0910FBA8C2h
                                                      dec eax
                                                      inc eax
                                                      mov byte ptr [edi], dl
                                                      sub ecx, 01h
                                                      mov dl, byte ptr [eax]
                                                      dec eax
                                                      lea edi, dword ptr [edi+01h]
                                                      jne 00007F0910FBA8A2h
                                                      rep ret
                                                      cld
                                                      inc ecx
                                                      pop ebx
                                                      jmp 00007F0910FBA8BAh
                                                      dec eax
                                                      inc esi
                                                      mov byte ptr [edi], dl
                                                      dec eax
                                                      inc edi
                                                      mov dl, byte ptr [esi]
                                                      add ebx, ebx
                                                      jne 00007F0910FBA8BCh
                                                      mov ebx, dword ptr [esi]
                                                      dec eax
                                                      sub esi, FFFFFFFCh
                                                      adc ebx, ebx
                                                      mov dl, byte ptr [esi]
                                                      jc 00007F0910FBA898h
                                                      lea eax, dword ptr [ecx+01h]
                                                      jmp 00007F0910FBA8B9h
                                                      dec eax
                                                      inc ecx
                                                      call ebx
                                                      adc eax, eax
                                                      inc ecx
                                                      call ebx
                                                      adc eax, eax
                                                      add ebx, ebx
                                                      jne 00007F0910FBA8BCh
                                                      mov ebx, dword ptr [esi]
                                                      dec eax
                                                      sub esi, FFFFFFFCh
                                                      adc ebx, ebx
                                                      mov dl, byte ptr [esi]
                                                      jnc 00007F0910FBA896h
                                                      sub eax, 03h
                                                      jc 00007F0910FBA8CBh
                                                      shl eax, 08h
                                                      movzx edx, dl
                                                      or eax, edx
                                                      dec eax
                                                      inc esi
                                                      xor eax, FFFFFFFFh
                                                      je 00007F0910FBA90Ah
                                                      sar eax, 1

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x9f80000x9cUPX2
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x9bc0000x1ce30UPX1
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      UPX00x10000x6810000x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      UPX10x6820000x3760000x37520085e89f99ece368201f51a3cb00bf05cfunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      UPX20x9f80000x10000x200c5fa83adc18106f3ea6152f7b9204861False0.1953125data1.3719135890817398IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                      Imports

                                                      DLLImport
                                                      KERNEL32.DLLLoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect

                                                      Network Behavior

                                                      Network Port Distribution

                                                      UDP Packets

                                                      TimestampSource PortDest PortSource IPDest IP
                                                      Oct 18, 2024 15:13:05.899127007 CEST5993053192.168.2.71.1.1.1
                                                      Oct 18, 2024 15:13:07.504694939 CEST6228253192.168.2.71.1.1.1

                                                      DNS Queries

                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                      Oct 18, 2024 15:13:05.899127007 CEST192.168.2.71.1.1.10x8603Standard query (0)time.windows.comA (IP address)IN (0x0001)false
                                                      Oct 18, 2024 15:13:07.504694939 CEST192.168.2.71.1.1.10xefeStandard query (0)time.windows.comA (IP address)IN (0x0001)false

                                                      DNS Answers

                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                      Oct 18, 2024 15:13:05.959482908 CEST1.1.1.1192.168.2.70x8603No error (0)time.windows.comtwc.trafficmanager.netCNAME (Canonical name)IN (0x0001)false
                                                      Oct 18, 2024 15:13:07.511831045 CEST1.1.1.1192.168.2.70xefeNo error (0)time.windows.comtwc.trafficmanager.netCNAME (Canonical name)IN (0x0001)false

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:09:13:09
                                                      Start date:18/10/2024
                                                      Path:C:\Users\user\Desktop\TU1ocSt1kw.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Users\user\Desktop\TU1ocSt1kw.exe"
                                                      Imagebase:0x4f0000
                                                      File size:3'626'496 bytes
                                                      MD5 hash:89F65AD79CAA39D402FC618DD3A49148
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:Go lang
                                                      Yara matches:
                                                      • Rule: JoeSecurity_HackBrowser, Description: Yara detected HackBrowser, Source: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:09:13:09
                                                      Start date:18/10/2024
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff75da10000
                                                      File size:862'208 bytes
                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      Disassembly

                                                      Reset < >

                                                        Executed Functions

                                                        Function 00561AE0 Relevance: .1, Instructions: 57COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                        • Associated: 00000000.00000002.1385500564.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000E35000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EAC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EE4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1386544134.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1386783366.0000000000EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_4f0000_TU1ocSt1kw.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
                                                        • Instruction ID: 637f864a560bbc567c2c6e9738f7aecf580184fee6d2422026e0c19628feb9c9
                                                        • Opcode Fuzzy Hash: cff9fe2135e67e95bb574443de1d06a8e0b8e89167aa2be6e3a61b8e8eda4513
                                                        • Instruction Fuzzy Hash: 1B31982391CFC482D3218B24F5413AAB764F7A9784F15A715EFC812A1ADF38E2E5CB40
                                                        Function 0055DE20 Relevance: .0, Instructions: 2COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1385523782.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true
                                                        • Associated: 00000000.00000002.1385500564.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000E35000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EAC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EDD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1385523782.0000000000EE4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1386544134.0000000000EE6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1386783366.0000000000EE8000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_4f0000_TU1ocSt1kw.jbxd
                                                        Yara matches
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 268ba60b3c818b95e08c10b1aade5e1cda301733b25fb3fe2c2d53ae400706ad
                                                        • Instruction ID: 1d1daccd1c3c13cf082bccc9fc19c68353b63486016a742dcbf091a2b770a3fd
                                                        • Opcode Fuzzy Hash: 268ba60b3c818b95e08c10b1aade5e1cda301733b25fb3fe2c2d53ae400706ad
                                                        • Instruction Fuzzy Hash: