hxxps://on[.]soundcloud[.]com/udCUYsPWJXA35qMDA

Analysis

max time kernel
1799s
max time network
1791s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06/04/2024, 00:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://on.soundcloud.com/udCUYsPWJXA35qMDA

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\1568373884.pri	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "1468"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\ = "1124"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "418527164"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\ = "1191"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "1469"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = c0482a7ebd87da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "674"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "1124"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\ = "77"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "469"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\secure.soundcloud.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\secure.soundcloud.com\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\NumberOfSubdo = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "914"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "983"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e1b51167bd87da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "69"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 8242a66fbd87da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1398"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b1b43067bd87da01	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\NumberOfSubdo = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\ = "1398"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "415"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1612"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "174"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "228"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\ = "843"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\soundcloud.com\Total = "115"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "1399"	MicrosoftEdgeCP.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4708	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4708	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4708	MicrosoftEdgeCP.exe
Token: 33	1212	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1212	AUDIODG.EXE
Token: SeDebugPrivilege	4280	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4280	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe
Token: SeShutdownPrivilege	1956	MicrosoftEdgeCP.exe
Token: SeCreatePagefilePrivilege	1956	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3768	MicrosoftEdge.exe
3036	MicrosoftEdgeCP.exe
4708	MicrosoftEdgeCP.exe
3036	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77
PID 3036 wrote to memory of 1956	3036	MicrosoftEdgeCP.exe	77

C:\Windows\system32\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://on.soundcloud.com/udCUYsPWJXA35qMDA"
1⤵
PID:4872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3768

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1336

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8S7W85J5\edgecompatviewlist[1].xml

Filesize
74KB

MD5
d4fc49dc14f63895d997fa4940f24378

SHA1
3efb1437a7c5e46034147cbbc8db017c69d02c31

SHA256
853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

SHA512
cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\SGNXKL62\audio-ads[1].json

Filesize
112B

MD5
8140ddfed850e1b239da601eddc7292b

SHA1
710a74a17f2d3b5ab3556f8bf5564bdef30d5085

SHA256
b3cd793908dce58beff248ea6adc41d52a2eda8878c06567c0f9dd7a9a591b4b

SHA512
dee7d373bf56a9466a95103048421f3831b3b38104645520ac1862bbb02c5ace33ef2312c91a1b875534e863afa0a0c0cffa27dd824c4eafe1d683c4bb7e502d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\ZELMLVRB\tags[1].js

Filesize
149KB

MD5
50c247a1ae6f7dd0ab6d11b82d28a8d7

SHA1
866655902cc3cf02f7a88adbf2899a8684bf9924

SHA256
d5925325f5fa5156ecbcb391e3dcef87e296c295c37c6e7c0a02593ed5a69732

SHA512
0e9428b72f1fe8fd4df0660d03cf26dfc37b9c47bc526f13528b37be894ae0656b4411431c41c2e27636061cd9e38430ef8764244557ead69e8f33c1c2cca73e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cookies\E9J9FPLH.cookie

Filesize
203B

MD5
a5c5d7a4225b5f4efc287b066145bdb9

SHA1
1e546396d5b01422b6cc40dab64606fd0e49571b

SHA256
16067f652f38a1151c3e500d8426d52d5f719932eeaada72eb7a99ee3944f9c0

SHA512
ff5e42767dc9b23dae43028fbd8047593b9f05fe251555cdd7d3b3abf489e75ccdfc778e164637f79dfd263d1ea16eb401b99166ee0f760fdf368e269a903c26

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
c1e47b5078eaffe633ddc6e199719e7e

SHA1
46703aa0a1e97bf06fb3d3b2d0eafa5d0f8208a5

SHA256
b7db2acb73a6879f16f735374d989e2baddedf59726f97611c619746087606cc

SHA512
380f9c12d7818e2d4cfc34dbc525346ad8bbf91c216854a85c36350d7931d4b79ecb6caa4fc4b8ba4278ec9aa0836ebf78893e32df1fa619b79433befb3e23a8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
19f7f7aeed54062bbfe901b7a64c2973

SHA1
45c3b682896d6ba6955456b3fada2d30f90bb040

SHA256
35f5be52c526a9217c099d7ef09a4848d281e67203c34a2271256d010b74d38b

SHA512
c171523e04f28cf416214fb14d1b614bd1060c83d3f46805d18ddd7bf1c8a9e0c1d4b6794e5782be0ee648be5e95b92098dd8fdbcd01b3d9a9833724cefa3068

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
3KB

MD5
c2dcab925a78042f3e28d3b07358de74

SHA1
e0ee8e5476f671a7d77651b0a647e493471aa639

SHA256
a31aee659b776ba796cdd48f624dde6d226c25d5ad12cba1556bb2e071edb5e6

SHA512
9bc08b92b75a6bdba8c6802e8334fb27970d472b66204fc141b53fbcc4674587c08cbf2bc9742e83d2bcbe37b4c64839c7df222cd7081efa9e712fd94580ca40

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
9e42c849e16a8afd471e52e1a4c0a2e8

SHA1
102e39718b596a03281e4a67518a7f27fd7e36dd

SHA256
94c2516588b17470b0344637239aff754883365af14a383de5bc08651cbdc050

SHA512
158e1ec01b38d17a13190e74d70c34026cceb9e8f2af6324e8ea5ad0521dcdc218b0b94a746524a58782928c2e5749cd63989c53faf48215badd652371417fc3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
1KB

MD5
e739dbd328cefe65726ae5642060b2af

SHA1
bab9a51c5f7ca79f68c7bd3d62a098f04718ec35

SHA256
bc41410b8b31e94839429cb7af56efc6655e611af7e0ba8a1c4bf800e37dba1d

SHA512
d0bc641e27a3817c3f4c9a8ffa8f828416421481013ab7ee08df736838fa7c30d262375b714c888e3c19ca44535549ddd80403d688330607ce09c71b2a65d08a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
1KB

MD5
f3c59edd5eee57fdc79145a394f54606

SHA1
353074f5781b6dfb360ef5150da2c431ccf51704

SHA256
ebaaa9fafc0d2105c42c52a9ea7a7fe304fa8bc097f7af054d0941c0480c94b9

SHA512
83373b2c97dab9b89a6e454fcfc36a4c43c86ac244b6d11d8ccc53f10a91b499b6cc2e83c436df26b011488131850c99af152b1c0d43d34e20c99b520f2d7129

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
1KB

MD5
d7f485f818eaec7b554ce1bca45887c4

SHA1
7276ec8d597670c4613a37b5b8831ec87a459406

SHA256
04ee5049dab60fb32ecc96d406c4aec8ecf2fdb335476a0c2a0d1e95e9523a4f

SHA512
3b7e145e2c7be7bae43cb61538732ec0a2c3fe6cb2896d62a94a81cee94fde14411545769c641e390edd8c7342cc65bde0246c84e53ff0fd61e90d0be5a07874

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
1KB

MD5
3317bdb8f2ce37ff4a122e4b4db5ac51

SHA1
78f221fc6c6d0f07f05c849ba471699e49746be2

SHA256
879f8fdf4c29659ff89231d5d8e2c3fa088be0d4b70c03a90ce0668c488dbd0c

SHA512
2141d1f44b72613a3eb7f66d00b3b0165b32219d44a53bc29c3d5e8a86be163bb3e7807fad54a3f1b04cd06df13fb31e679c71b88fcca3ab43eeff5334688bff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
6715551c238519d498456095943bf8da

SHA1
e626a36fd1896d7be556e9421fd46083a4f8791e

SHA256
9126c258ea80d59fe290f4bc2d0cc10db4298efd8b3dd0b42b054fabde5c8a05

SHA512
0b93fdaa001b74846aab0df82a5cf7fd8fc6fa73da368914732df9c80b5e79ddcd335466c6befbf2ceaccb92a2922eb22f14611381b4301e3bfa4d8fb2747564

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
1KB

MD5
13b3d5e6dcc1d031e9d393d51414ca75

SHA1
6e709b8fe0d31ccf4752e71cf40f3d1f7847e1e0

SHA256
dda2c609cf54e234f43ea027a70796235cd5563842be18e5d8d33f483a4bc6e0

SHA512
f9c422e37c3d18286659f1fadfc7bada30f448fa75a38538cce99ba011042d43bc77b292b2c9ceeebd2ec5a7736d75eb8113275d8e7f37d642890772c3ac8375

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
3b8afbd3f7317e04b5056c1417a739c5

SHA1
32cca45a9c1d8be1246f8f4694d2b5802a8e5a7f

SHA256
d6ea0cdbda57ee013453a2cca0b0febfa97c1aa128bb9896905775793f08f634

SHA512
58a5d2755105a734984933cb458cdd9755b23ab21d8f8ae9be5dfe7e80c521fdb6ffca2c03f9a27aec4df4b8ec846039fb3c9d2cf6a64c05f8235d92d855abfb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
f8dc6f851d990512b9a40286fd1dd76c

SHA1
389ce348b2a3d575a24c978ac28743a705d9b63b

SHA256
ad03e1f23a51a72e146adc4c819422bf8dd385c7efaa424cf3f7014e7252e183

SHA512
3e4ce4818758b38e0b7ce7f6b9539a63714208b82a45dfb8bcfdc8daea7bffd3eb7d6a35f9e14c341177e51e48bc4a4170eb99538e75b1a0a863c01b95f14dd3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
3de0ad588da8bb0cd5f5a5c90fe325e5

SHA1
914d9c3e694f280444ec8f613e626f49ae9a2d3c

SHA256
0e0badb79235f2c0d87b56edb1cc3224bffdd0ca8def865815afd206bcdc91d1

SHA512
be3ff806753455dcf1f09566043f17721093e3820931b52f90bf0e0864dda6d3a92a87b9370feb2dea89f31e7dd502fc05fa4e7315adefa065f77d7b28a41528

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
e5e8be49235565112ea8f89aaa355294

SHA1
648e9e3fb387a9bbbe33e78b71771d6c72465e7e

SHA256
639a57eb8ffe88601c7252dfc09d3aa5a607dab52c790fcc89b8684914d4607a

SHA512
88f7220c95d5eb0c3da7acf616477a396c8b6e6b3d08bd05ed82cf80033b2ce416f427718e10e9995271fbaa1b61fc1ea0a60798101c0f0e0030a0c9357e0fde

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
67881749dc1627aa14fb7a7b7f72d97d

SHA1
feb438c170c75bc226afb4ca46c448f9d882ece4

SHA256
b155b7c5044ac9b98066baab0d68001eb89f06d4a2fb53f0aa5a3d7ca7cdebae

SHA512
9908426acf2c42ab52be665ebb6093731195f27380d639ccbc7fde62306514df0ec11bfaa001dfdc96e6ba73b50492d7feb3f5a13d3660cee81ffa743c68884c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
0e885469fa020155772fa6c03ab81edd

SHA1
5cb9dcefdc68c9a82590a3cf47c3095274f20610

SHA256
d021264102fd033c60c89680e063bc6987f077ee1f64796272d2f544e48c1b20

SHA512
f70ac1eab44be5503a1413eac5cd9b55a250a9725bd2e09a9219acf9ac6b27658aa686f08694c3c59f42a3fb6c99b7db2fe7bc347e899ad1a89414d6988e116b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
f619fb0e3a3fb44d4b2b45157270d78f

SHA1
b6a9fb7f99cb3d50f3c11f8b6571395b1161a626

SHA256
f1cccced70e8767f1d829e13f3553fc739805d1a2c5028e97d6e7b207a0f5e55

SHA512
6640cf2afe45b7502399859351765442a05c1e1ec259e02c5bdbc93e69be57a33dcf98dca0d487c17836f15aedfc67814532f1c5245cb4877e4e67bb819036c8

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
ce3c3ea6800a70a99bed1a4539022478

SHA1
7a0def534e44ba809c68d089356bcf1c970c7fd6

SHA256
540bb45d02bb3e1e7132f4a7da0da59707f7a5db4fabc51bd89b247bb5f581ca

SHA512
76c73ea188e298771c3ec0d72c3fbc6a5815d12b40d06891b3a8da6f093202bd169e9961b1165fa57f2605165d3241d918d80ac24137d028fc8d748254b0434c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
052d03ebd76b3bab02fd3d77fc3468b7

SHA1
eedd93aa1e3aa39b5ad7c081f729ae21308785a7

SHA256
e4735e711f79313cba02ad5ee07e846dd57b60f0d3118054f1bd4e091305287a

SHA512
23950d82be092ac512742bf41551df9f03b34551f93a09417ddf0565b6f64ff1a4338b668981b969b1dbde177ef8f0c678c53f16c378e523d1a17ffea4d25f3a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
720d27dd92c592e0c474e1bca294d9b9

SHA1
53680e1af44affce498d991da74ddae13bd8a022

SHA256
db59c1ae52572871a383e9498aebbc7c69b176ad4f3318209c0c7bf6ba4e8944

SHA512
fa459f5a04eb0ea793eabf91169d262fafadfa5ba2b3f9abda8bc0d1970fa98473a5e982a2253b2370c7fafe8cde91ee0b07945c346700367eac7b5d99a6d5ff

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
de86f3f100ecb940423d69218740fa25

SHA1
88f79d3be1e07cc4530a553042ed85bcb4d70fc7

SHA256
d8fedea985010eb4a7df4ee3466009872ed9607bc92943a1b61a44c8026bd4f8

SHA512
c471ce639db673ba141e7f02364a9a02616a0a0f2f8e9d4bdcd43c7c632bed6e067f3d75d28c53be7b2cf84a539d7ee1b982e7535cbff04ae3b18a5a64c3aaae

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
d13841628a5b3d037967b96a109e111c

SHA1
4e090f4e6b2763b8d5a435d0df14d13d14398317

SHA256
11f598ef5d6cc5751df30f963e9663b67fd3a4e325600a43b6a52015d68095a1

SHA512
05a3634bf589359f6def83d239070ad4d02a58b6cc1f6cfa2d1249679ac73a3e9b6d3783c1230d888e7ac74d5b76a0591111942fc92722ad50d2cb42e2b41189

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
c8179513ce05d0677072ad7207b198ec

SHA1
5a7d346b2d235d28bd80bf4cfca1c833f542fac6

SHA256
08c0eca18f2aa5a26dd520a34264b125862a58c2035b4bed25d33d77fd974881

SHA512
c5b5bce7a54e8f03402f8b78d5cec81c09c744cd28035799249714063f2ce2cb4eae764cc5be58a843142c3378d642e291af2748bf9df0e774521ac91d984080

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
76260111a362fa006c54576f844ccd9e

SHA1
23676ad7056ad0a54016a3b64531150448ac5ab0

SHA256
2c2e06612d69e6b2269888424a4530aab0586c0470f24ae518d8a8d6ee00502d

SHA512
6964978a15bfca4647c3c760c2e6fbbeb99cb6246b485e97bdce2f5487e7935e47d478432da0ad7eb35da9eddf672f88432fed861a50ced96cfb7dcee00ddf89

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
3KB

MD5
f618201bdf07b565c94284a210be396f

SHA1
5edf85b373c8b7d1acf7b41626a61dd78ee2c83a

SHA256
89c28fe79a93e3af878454b8b8c42c29880a67a57939e26623e8116e2306a49e

SHA512
8a7846059ea166a6ed85a8df56062b9e4a2f95437dbd899e69aad3f956b6acff046f59e985334ecb395bfab5340372a95df74bfafc16f764bdf0f8ce2408a2dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
23cefc3af89d774be13a9477c0fa4ae9

SHA1
8638437c368f765c8b88e47f0d9e40117393fd4b

SHA256
7337d81fed93aceb113ec870fedd392e2710c9912103f445790066974afa7710

SHA512
b61789897c2af2b73e20b30687d789febbe913edef50e03cac7f07dfb73499f028c4e5e34b5d9c7a70eb332cc7f802f0ca31b88612fd2c03e1b81f372ab69c1c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
2KB

MD5
d365b504b07fee966bbd93ad37f09f7c

SHA1
01618e0a1e2d6af341637d0bf6f4c6b5c3808929

SHA256
6acdef10eca0e80a4d7b35fd92efde2d62921e18e09027fe2bd5ea5ac452e041

SHA512
b173c3a5f9c614420203ea9b2116aff6aafea0aa6e2276f1b0bbdbb1c93fa3a75933962b6be02a3017c60ec18232fd16c1a7dd719e96d5a5424930c1fe8bec49

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\FZLRZ4FI\soundcloud[1].xml

Filesize
3KB

MD5
fe88b3a32dad479d0591a146ca846eed

SHA1
bcf1df81dc73a23a7349a2ca6dafb0cd0f7be9e4

SHA256
16e7fc79f23b4ddb0fae9db6a56cfa34b705b59bf11ebd2d0f69766101ddcdd0

SHA512
87264ebdd9f0fbd686f405a228c30d1d9aece322d6a6b20d4c038bfec749cf6cb7657ddc272d0312f7194f91a4e09bc9221fd14b952c295fefef39d04becc08b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\User\Default\DOMStore\T3S9FZ0D\secure.soundcloud[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\AE987MRN\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\GW6NTC1I\favicon-2cadd14bdb[1].ico

Filesize
5KB

MD5
2cadd14bdb5703d656a0fed6e61b90f4

SHA1
0b96af09d59d307af38f1e295b088e9e9dd23d2f

SHA256
bc4292cb5493196e4b700431d1722fdf2909f0b3857ff36868af54f64069d21f

SHA512
80398b7f9ff1bdbec34818c2886a88aa63309e0436235e1c529246b094103d01646e3fa231e0295e5174563977eb3e7b769031c9d60d5d0834d5e54b523286bc

Download Submit
memory/1956-368-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-374-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-293-0x0000018658410000-0x0000018658430000-memory.dmp

Filesize
128KB

Download
memory/1956-66-0x0000018652220000-0x0000018652240000-memory.dmp

Filesize
128KB

Download
memory/1956-264-0x0000018656670000-0x0000018656690000-memory.dmp

Filesize
128KB

Download
memory/1956-295-0x00000186585D0000-0x00000186585F0000-memory.dmp

Filesize
128KB

Download
memory/1956-257-0x00000186565D0000-0x00000186565F0000-memory.dmp

Filesize
128KB

Download
memory/1956-255-0x00000186565F0000-0x0000018656610000-memory.dmp

Filesize
128KB

Download
memory/1956-251-0x00000186546B0000-0x00000186546D0000-memory.dmp

Filesize
128KB

Download
memory/1956-128-0x0000018652420000-0x0000018652520000-memory.dmp

Filesize
1024KB

Download
memory/1956-122-0x0000018654BD0000-0x0000018654BD2000-memory.dmp

Filesize
8KB

Download
memory/1956-120-0x0000018653DD0000-0x0000018653DD2000-memory.dmp

Filesize
8KB

Download
memory/1956-118-0x0000018653DB0000-0x0000018653DB2000-memory.dmp

Filesize
8KB

Download
memory/1956-116-0x0000018653D30000-0x0000018653D32000-memory.dmp

Filesize
8KB

Download
memory/1956-83-0x0000018652400000-0x0000018652420000-memory.dmp

Filesize
128KB

Download
memory/1956-343-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-375-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-346-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-342-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-372-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-371-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-369-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-367-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-365-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-362-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-360-0x0000018659BF0000-0x0000018659CF0000-memory.dmp

Filesize
1024KB

Download
memory/1956-352-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/1956-351-0x00000186414A0000-0x00000186414B0000-memory.dmp

Filesize
64KB

Download
memory/3768-289-0x000002C07E950000-0x000002C07E951000-memory.dmp

Filesize
4KB

Download
memory/3768-0-0x000002C078120000-0x000002C078130000-memory.dmp

Filesize
64KB

Download
memory/3768-281-0x000002C07E940000-0x000002C07E941000-memory.dmp

Filesize
4KB

Download
memory/3768-35-0x000002C078400000-0x000002C078402000-memory.dmp

Filesize
8KB

Download
memory/3768-16-0x000002C078A40000-0x000002C078A50000-memory.dmp

Filesize
64KB

Download