lumma | hxxps://www[.]dropbox[.]com/scl/fi/5xgphf3srvo005sux8d56/MasterKeyX_Pro[.]zip?rlkey=ydmy472krtm9tci80mfhpivo6&st=wc5mzc5m&dl=1

Analysis

max time kernel
254s
max time network
261s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/scl/fi/5xgphf3srvo005sux8d56/MasterKeyX_Pro.zip?rlkey=ydmy472krtm9tci80mfhpivo6&st=wc5mzc5m&dl=1

Score

10^/10

lumma vidar discovery stealer

Malware Config

Extracted

Family

vidar

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Extracted

Family

lumma

https://toppyneedus.biz/api

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/4016-972-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7
behavioral1/memory/4016-974-0x0000000000400000-0x0000000000422000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Downloads MZ/PE file 1 IoCs

flow	pid	Process
130	3456	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
4708	MarineAquarium3.exe
208	MarineAquarium3.tmp
4492	MasterKeyX_Pro_v4.3.exe
2400	MarineAquarium3.scr
4952	MarineAquarium3.scr

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	MarineAquarium3.scr
File opened (read-only)	\??\N:	MarineAquarium3.scr
File opened (read-only)	\??\R:	MarineAquarium3.scr
File opened (read-only)	\??\V:	MarineAquarium3.scr
File opened (read-only)	\??\L:	MarineAquarium3.scr
File opened (read-only)	\??\N:	MarineAquarium3.scr
File opened (read-only)	\??\A:	MarineAquarium3.scr
File opened (read-only)	\??\B:	MarineAquarium3.scr
File opened (read-only)	\??\X:	MarineAquarium3.scr
File opened (read-only)	\??\S:	MarineAquarium3.scr
File opened (read-only)	\??\H:	MarineAquarium3.scr
File opened (read-only)	\??\U:	MarineAquarium3.scr
File opened (read-only)	\??\Y:	MarineAquarium3.scr
File opened (read-only)	\??\B:	MarineAquarium3.scr
File opened (read-only)	\??\M:	MarineAquarium3.scr
File opened (read-only)	\??\W:	MarineAquarium3.scr
File opened (read-only)	\??\Z:	MarineAquarium3.scr
File opened (read-only)	\??\E:	MarineAquarium3.scr
File opened (read-only)	\??\G:	MarineAquarium3.scr
File opened (read-only)	\??\L:	MarineAquarium3.scr
File opened (read-only)	\??\A:	MarineAquarium3.scr
File opened (read-only)	\??\G:	MarineAquarium3.scr
File opened (read-only)	\??\Q:	MarineAquarium3.scr
File opened (read-only)	\??\V:	MarineAquarium3.scr
File opened (read-only)	\??\Y:	MarineAquarium3.scr
File opened (read-only)	\??\J:	MarineAquarium3.scr
File opened (read-only)	\??\K:	MarineAquarium3.scr
File opened (read-only)	\??\K:	MarineAquarium3.scr
File opened (read-only)	\??\P:	MarineAquarium3.scr
File opened (read-only)	\??\S:	MarineAquarium3.scr
File opened (read-only)	\??\T:	MarineAquarium3.scr
File opened (read-only)	\??\Q:	MarineAquarium3.scr
File opened (read-only)	\??\J:	MarineAquarium3.scr
File opened (read-only)	\??\O:	MarineAquarium3.scr
File opened (read-only)	\??\O:	MarineAquarium3.scr
File opened (read-only)	\??\X:	MarineAquarium3.scr
File opened (read-only)	\??\I:	MarineAquarium3.scr
File opened (read-only)	\??\U:	MarineAquarium3.scr
File opened (read-only)	\??\H:	MarineAquarium3.scr
File opened (read-only)	\??\Z:	MarineAquarium3.scr
File opened (read-only)	\??\T:	MarineAquarium3.scr
File opened (read-only)	\??\W:	MarineAquarium3.scr
File opened (read-only)	\??\E:	MarineAquarium3.scr
File opened (read-only)	\??\R:	MarineAquarium3.scr
File opened (read-only)	\??\M:	MarineAquarium3.scr
File opened (read-only)	\??\P:	MarineAquarium3.scr

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\is-KKC2S.tmp	MarineAquarium3.tmp
File created	C:\Windows\system32\is-7SOVA.tmp	MarineAquarium3.tmp

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 812	4492	MasterKeyX_Pro_v4.3.exe	151
PID 4492 set thread context of 4016	4492	MasterKeyX_Pro_v4.3.exe	158
PID 4744 set thread context of 1588	4744	MasterKeyX_Pro_v4.3.exe	161
PID 3076 set thread context of 3768	3076	MasterKeyX_Pro_v4.3.exe	163
PID 812 set thread context of 4232	812	AddInProcess32.exe	164
PID 4744 set thread context of 2940	4744	MasterKeyX_Pro_v4.3.exe	167
PID 3076 set thread context of 2936	3076	MasterKeyX_Pro_v4.3.exe	169

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\www.SereneScreen.com.url	MarineAquarium3.tmp
File opened for modification	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\ProlificSignup.url	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\unins000.msg	MarineAquarium3.tmp
File opened for modification	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\unins000.dat	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\unins000.dat	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\is-0AAIA.tmp	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\is-VOPRA.tmp	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\is-RRBL9.tmp	MarineAquarium3.tmp
File opened for modification	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\www.ProlificPublishingInc.com.url	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\is-FI8PR.tmp	MarineAquarium3.tmp
File created	C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\is-9JFPP.tmp	MarineAquarium3.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarineAquarium3.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarineAquarium3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterKeyX_Pro_v4.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarineAquarium3.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterKeyX_Pro_v4.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasterKeyX_Pro_v4.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MarineAquarium3.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 613137.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
5100	NOTEPAD.EXE
4340	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
2424	msedge.exe
2424	msedge.exe
4984	identity_helper.exe
4984	identity_helper.exe
3056	msedge.exe
3056	msedge.exe
3400	msedge.exe
3400	msedge.exe
4492	MasterKeyX_Pro_v4.3.exe
208	MarineAquarium3.tmp
208	MarineAquarium3.tmp
4492	MasterKeyX_Pro_v4.3.exe
4744	MasterKeyX_Pro_v4.3.exe
812	AddInProcess32.exe
3076	MasterKeyX_Pro_v4.3.exe
4744	MasterKeyX_Pro_v4.3.exe
812	AddInProcess32.exe
3076	MasterKeyX_Pro_v4.3.exe
812	AddInProcess32.exe
812	AddInProcess32.exe
1588	AddInProcess32.exe
3768	AddInProcess32.exe
1588	AddInProcess32.exe
3768	AddInProcess32.exe
1588	AddInProcess32.exe
1588	AddInProcess32.exe
3768	AddInProcess32.exe
3768	AddInProcess32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeRestorePrivilege	3232	7zG.exe
Token: 35	3232	7zG.exe
Token: SeSecurityPrivilege	3232	7zG.exe
Token: SeSecurityPrivilege	3232	7zG.exe
Token: SeRestorePrivilege	1688	7zG.exe
Token: 35	1688	7zG.exe
Token: SeSecurityPrivilege	1688	7zG.exe
Token: SeSecurityPrivilege	1688	7zG.exe
Token: SeDebugPrivilege	4492	MasterKeyX_Pro_v4.3.exe
Token: SeDebugPrivilege	4744	MasterKeyX_Pro_v4.3.exe
Token: SeDebugPrivilege	3076	MasterKeyX_Pro_v4.3.exe
Token: SeDebugPrivilege	812	AddInProcess32.exe
Token: SeDebugPrivilege	1588	AddInProcess32.exe
Token: SeDebugPrivilege	3768	AddInProcess32.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2036	2424	msedge.exe	84
PID 2424 wrote to memory of 2036	2424	msedge.exe	84
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 2292	2424	msedge.exe	85
PID 2424 wrote to memory of 3456	2424	msedge.exe	86
PID 2424 wrote to memory of 3456	2424	msedge.exe	86
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87
PID 2424 wrote to memory of 2864	2424	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.dropbox.com/scl/fi/5xgphf3srvo005sux8d56/MasterKeyX_Pro.zip?rlkey=ydmy472krtm9tci80mfhpivo6&st=wc5mzc5m&dl=1
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad86346f8,0x7ffad8634708,0x7ffad8634718
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14014663487851438143,4417658138694710164,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2756

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap16451:90:7zEvent32141
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap8328:88:7zEvent16796
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Manual.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5100

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4340

C:\Users\Admin\Downloads\MarineAquarium3.exe
"C:\Users\Admin\Downloads\MarineAquarium3.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4708
- C:\Users\Admin\AppData\Local\Temp\is-3PBKR.tmp\MarineAquarium3.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3PBKR.tmp\MarineAquarium3.tmp" /SL5="$F023C,4133510,798720,C:\Users\Admin\Downloads\MarineAquarium3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:208
- - C:\Windows\SysWOW64\MarineAquarium3.scr
    "C:\Windows\system32\MarineAquarium3.scr" -register
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:2400

C:\Users\Admin\Downloads\MasterKeyX_Pro_v4.3.exe
"C:\Users\Admin\Downloads\MasterKeyX_Pro_v4.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:2372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4016

C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\MasterKeyX_Pro_v4.3.exe
"C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\MasterKeyX_Pro_v4.3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:1924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:1832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2940

C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\MasterKeyX_Pro_v4.3.exe
"C:\Program Files (x86)\SereneScreen\Marine Aquarium 3\MasterKeyX_Pro_v4.3.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:3960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:2936

C:\Windows\System32\MarineAquarium3.scr
"C:\Windows\System32\MarineAquarium3.scr" /S
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
734B

MD5
e192462f281446b5d1500d474fbacc4b

SHA1
5ed0044ac937193b78f9878ad7bac5c9ff7534ff

SHA256
f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60

SHA512
cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A55FF92202769984EA0FCD993F41691

Filesize
345B

MD5
0a4ccb656ca61bbc3dd96fb409d76ff1

SHA1
4338ba76cba7e2bde6722dece301e0ee17ee8f78

SHA256
b046c3cbd4c9e0a8296840dc610469bab5cb561afbcf63bffb330f09c23c51db

SHA512
99904a49f6389a9acebb4196a4885ee5f962958776199f40972406379dbe74c00df50e5fbb7de3b58ffe5cb59878c13c165fac6bd9db087c0a369a61a1c36593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
fecc1788e505296111aab20b0b0371a8

SHA1
8ebeb5844c40ef0ab5f8ba42464e70ad9c2d2644

SHA256
60c05696c9248b3afd9825b4b9f7e4099d1db25e625685fe1fe04e5c77ecd154

SHA512
0ed4ffa0045537bc2ee0b65094e96e0f990f25abec40fa388e55e26d9c1d359209c37637a688a309cd0017b2174ab17d91fc56ba425de185aeddfe63ca007bea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A55FF92202769984EA0FCD993F41691

Filesize
544B

MD5
bdb95bf0fd4deedeb88f82740c56b505

SHA1
06ba94ad32633a8885583e8d44aab394ff97e8e7

SHA256
77a8f5ec5229a0c4b90acfeac42dc4b3516eb2b6be4c34c3564eb32bbfe38fde

SHA512
23fe97c160c268f1bf4185b945dcd7423a639e30ab5dc765833b0f5110dc147e3604d692182e36d9371ecd4ffa2a7d302839e078396eaefe1b047351d6fdc454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MasterKeyX_Pro_v4.3.exe.log

Filesize
1KB

MD5
659a2e9e8ca92b3f89056c85c82f51c6

SHA1
bdf8452b0cb5aa2f37826f9af8e3182331ecd0c0

SHA256
ce68b74bfb3a2bc831aa381058a7e50580e4745ad53e2b17177d98dc541ff3e0

SHA512
376be6ac8c7619ae906098c53d136c8045559f1d71b4468fe643c40b504151cfaba139ac275aa0f1a209aa4dff75a4776080b89c8771a4ede8f509e310243b4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
215KB

MD5
7b49e7ed72d5c3ab75ea4aa12182314a

SHA1
1338fc8f099438e5465615ace45c245450f98c84

SHA256
747c584047f6a46912d5c5354b6186e04ea24cf61246a89c57077faf96679db6

SHA512
6edf4594e2b850f3ede5a68738e6482dd6e9a5312bffa61b053312aa383df787641f6747ac91fa71bb80c51ed52a0c23cc911f063cd6e322d9a1210aea64e985

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
20KB

MD5
a8174c9a4655557472047b71f38662de

SHA1
bc82b31b0f7391e7a148e1f8192f6ac54ab83e06

SHA256
e4a9f323df331aa8e398510bdbd05c08a1b28054651ee11e07faa37868d4e8c4

SHA512
e954361a33dd9905bdee6fab500deee684eebe03ba6d9ce790add0e7b9021aa42b0b0eda9354d30ba63ca4557d2fb834138ef30d45cd67052e358e1643863826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
c22a55304b695e7d31d6fefcb5417da5

SHA1
d17c642bf441fc2838e36d55875bcf7c134d2764

SHA256
7f4d1a9b8c0aba511c9d7a4d495b8b885752d7b5323163e4cdcbd312b0038660

SHA512
0adfc18ec5956bcb9b2802dba7581173dc9638e17f8ffd2f4655fa979cc093c340fc50af695328b5205ad3e278e67e5152545b24a38aed6858ce74dd933c34d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
99bbe21b75bbf43c922658b7f54ed8d2

SHA1
b63a0eeecc07cb8723384bb3ce93cf6df2c0f195

SHA256
8717ce730e93d89daa5061f8f9e03a3987f2ab860b39122de444ede20c3182cb

SHA512
0a63d5c1d8d71bea269d2adbc3c7f79d3cd7bd7cc30594b142a87f20caa31a196a526a12be74a6b5db378dbd58f430234a7126b142712accaa760c8d5773b05c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9d9eb9a9356f5c370b71e57ded6ad67

SHA1
c94f4db1ee296832a6cd9f11432ccf92543afd88

SHA256
19289694477b0bb5257d98692955f7a05c9afcdbdb15c0fb751159ea7f748b3f

SHA512
ebae8b22ba77c49275cdf755acbb768319e4ac2a2a0ac00064a9f7d9cbca4f67a2f45f89d8f3b20294209ce7c66b9d764e2b85b2ff0bf8c4f8c9832052de5c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
221721e3e6abedf88b1c1418e069bfeb

SHA1
8de6397429b91be44752c84829bb30bec6989deb

SHA256
5b0833bc093d29e5a3ea38994970ce267c52f85018b49b1ce54e7ae19d301847

SHA512
13a57d346c8c86421c01a8ea445ce4ba15f17b9f158bcef5363842c64ca5bbb8165354880c31f1b33d2c856b028702e77d3877b1ef4d54be6f2c8e87a0d757e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a6bc4def283e4bb4cd9b334a1d5edb7f

SHA1
16c3c9cb0c423df223099efbe8ed7c2493507eb4

SHA256
fbe3ae22eb8e45289402f1d934cef4a041590ed657801afe39de541081cc834c

SHA512
a39b9f96dc1bbf5bd9f5e2990a51c3a536a1f411c7e7b402c32dad422ec190c098c014b4b6adfe64fb90c1cae124ee5ce4287926ad129c68512ccb7d9068e3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
599239e82d8dc0d22c00fac65bb0c955

SHA1
ccd1a20b9727ed5fafb54623f102448093291b96

SHA256
a5dd4256e777a80a9df0aec2956b39e34146ca7accd659d21d5317f1609cd83d

SHA512
e7f58eb555b7ae71c1658b8c7fdad3833e86b9c4ad2c4670461a47db8b517b59ca9cc842fdfc12556e0a3d76e3ad8a5404d7e2c8d2ac0a6bc8293972f1f40c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
daff3b7ed1f7a36dd076a9d24b67cf6f

SHA1
554da6f20dccaaec0643f6294fbc80295f2e5539

SHA256
0ec93c31e7a2960680a0ac33ffbb1ee87ba30954cfe4a99f0888360cd2c7d31e

SHA512
2b90dec6c39e1835461508343120e5eb95ffbd41097a0697dcb5c598ceee24d1ab2adb09af9fce3cfc727b2593bf451aabcb4567b8f199148c36d833f46dd8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1d1d0cd8773ae865e7f994653676d1f5

SHA1
2d2f3ef9fc05a25282cef811de8c895b8c8e1527

SHA256
a353f7b3a32c076cd487ffb4aac25f5b0b4ab2343019fd13069f212f8e4c5a41

SHA512
c0013a612f76807ff810aa1a4b3911ca4245722387377003024833f88a0a08f55108b57a051286934d2eaf73836676a04952f4b2383c0b5a72c7aa42f6730763

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4147e17bda62c1414e23e30e8c324e2

SHA1
214d25a7fc84ca445a5bfe064a74b2f9312010a6

SHA256
45a4828fd88637b5e0389a94f44d7d76d66aa48f338d73b73459464be3d70334

SHA512
31d896290f1081f66c2d628d5e99b8b1a8368b0ec1097e57b8a3639da858efe628cee3fdbd9bf6436e558fec9b0e6688559122de79018fc2a6d67ba4cfaccafa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a99a92a10f81f6ac346f5d97049539dc

SHA1
8dd62ff940772a29b92cba10f847badbe5e2ef44

SHA256
543570312ab0103f94a17897eb8ff24145c7cf1a53a913a3254d093776d330c1

SHA512
bcb9d4b2d7dcf6e5e1bae39e27874cbef92d594bb5130d05ecfb0e1a4a2880aa43bb5163afe5bb25890b98c8aafdc76625562faeb9d06a654018006ba2076768

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d3a.TMP

Filesize
370B

MD5
a2abd5fa66f6001e4e1faf555d239cab

SHA1
ec9de91de94bc6556c4bcb8914de04c679930cd9

SHA256
20f4d90c0e4fef89a0976ab7cfc6a7e34c45c49d7e73d6cb0f185814a8fabc3c

SHA512
7211ba0a459de47fbb6f457f4a1c142deb3635a81260bd03f44119de7d300a501fbdcf17d2e2f98eba74d6667ab470990218e73301a914b19968e32af984f410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a14dec42a013d7e790e36c452ac94c3f

SHA1
3c4b0fd9295de29843c51dd63a6a02c66bcfac7e

SHA256
8be6aae0a54f07827b1b0fe3f63646df2b45a372726c13d7fa015d590b87a36f

SHA512
135d17ea1b7d4a39c9b231cd5ba91aaa3b92e0b49e7b4ad6ea47569b5b84d3eabff1a6122379500cdf489d147e70bfc88eba4fddf07de7ba021d01bf150506a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dbed632fc54adb3b10a5606536d87432

SHA1
3eea53ffae3de12d66b09a6b7aa3e7bf18a6d288

SHA256
28d4d536812db37fa3131c0bd876bb995717d8a9a39cb7f8822b2d26895e3ed8

SHA512
e7e966ea3da48a23f24d110b5d1f0046b3cdfe2596529c64b5386e98895b002dbcdc17f2e3fc0a5cae20e44fb2488ccad6196228faa67f4b3256a06c8475bf37

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3PBKR.tmp\MarineAquarium3.tmp

Filesize
2.5MB

MD5
daa29183406deb91aaf9c466726d6ab6

SHA1
ee81e05c839c7a7770585216367b80f53a93f1d5

SHA256
52b86c9d4b8810a224b27c185fcf12d5fb32c4d87507fe4d98976d97f44d6569

SHA512
4c8f1471df72680ea03e6432e758d57dbc1d5fc0d56c8f2965b2db2787ad83febf29c399894552c53f883321dac5bdce78fafafbd22cb25d305be4ae1f8f3ead

Download Submit
C:\Users\Admin\Downloads\Manual.txt

Filesize
109B

MD5
df1d88cf3ca033d49b550355e0d0cc23

SHA1
3088678571aab63ba52a5a6b97f43a588b56f240

SHA256
2b1867fc5400ff2efb25ea7913cfd970aca47e0f08931e5eff4b84628ee347cf

SHA512
79a5576fc024d18345816919a03985347ffc092c310d87aca32947cf715d4e5a078e38bf8cabdb7c7fe134e302c86270c7662222268590ac0b0bd551096177f4

Download Submit
C:\Users\Admin\Downloads\MasterKeyX_Pro_v4.3.exe

Filesize
782KB

MD5
759ab3658c9bc6af1d9885d549173ebf

SHA1
d8495e9cc8ef8f80a4a149aa633964fca3e08ae3

SHA256
09267e88154b76a263fd7501e1325744a316ac686182c175de0f383a6616d6f2

SHA512
b3e3bf950a95f68237ff96b1e679acbfe6715094e9fc0a48dba227cabe0e82f2fa7b9f2346330b594e4111ffb11dcdb5500b58cfde99c441e470ad24724a271b

Download Submit
C:\Users\Admin\Downloads\Readme.txt

Filesize
106B

MD5
33c9915b02194bb74e44c2cacc4bddc7

SHA1
c38527c5e50b20a1155dd36fdbb6df6ccf364726

SHA256
4b64ccae9b409a4d6ff725d3662141407846b43f21a1a2b1036cf4c46794b2eb

SHA512
d108893b6f3862170c6a1a4b24f0e5d458eef43d8548abff13fa3cf078fc84d72d1471b32936f84583fbf1c8583210503b63a38cbf9e4be46a333f2a2fd56065

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 613137.crdownload

Filesize
4.6MB

MD5
b9b9c2cffd93f6ae2aa8336f26d38923

SHA1
86ad72d0f69018ff0ba667d24e71d5b635cfc928

SHA256
e5c3ce07ec40a8a5d946cf2353d607780afb0065276d9ce9f1e45aabb73d0fd5

SHA512
6ae1a7da930542a6cff358e375486f0f6a55e4a9ef4ad875bf67e64fb9890001b4639482a28cddb642a37173e3f6c99b01a186295694b1dc44dd6587d9edc99e

Download Submit
C:\Windows\SysWOW64\MarineAquarium3.scr

Filesize
6.9MB

MD5
e8a1fee5a2e22c4ffe9b6df374d41bf3

SHA1
ae6c17a1f08d64dadfa0168804b4bf0e04ab1a90

SHA256
26d4bad747d764fdcc340cf84b0230e857c800606f14e6911c4e4dcd0b5aed9e

SHA512
2586780ff35b865a1dfa759de95ae42dfac62c8ec8a9746a1309179246f160a2b338c772cd0dc5e55d33353da09c733420bbb85110671b3a1ca26e0e531b3853

Download Submit
memory/208-875-0x0000000000400000-0x000000000068C000-memory.dmp

Filesize
2.5MB

Download
memory/208-933-0x0000000000400000-0x000000000068C000-memory.dmp

Filesize
2.5MB

Download
memory/208-926-0x0000000000400000-0x000000000068C000-memory.dmp

Filesize
2.5MB

Download
memory/812-951-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-935-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-940-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-941-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-943-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-957-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-959-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-962-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/812-937-0x0000000000400000-0x00000000004DA000-memory.dmp

Filesize
872KB

Download
memory/4016-974-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4016-972-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/4232-983-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4232-984-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/4492-927-0x0000000008240000-0x000000000825A000-memory.dmp

Filesize
104KB

Download
memory/4492-883-0x0000000005680000-0x000000000571C000-memory.dmp

Filesize
624KB

Download
memory/4492-884-0x0000000005570000-0x0000000005592000-memory.dmp

Filesize
136KB

Download
memory/4492-885-0x0000000005610000-0x000000000561A000-memory.dmp

Filesize
40KB

Download
memory/4492-888-0x0000000002AA0000-0x0000000002AA6000-memory.dmp

Filesize
24KB

Download
memory/4492-928-0x00000000067A0000-0x00000000067A6000-memory.dmp

Filesize
24KB

Download
memory/4492-887-0x0000000008470000-0x0000000008732000-memory.dmp

Filesize
2.8MB

Download
memory/4492-882-0x0000000005210000-0x0000000005564000-memory.dmp

Filesize
3.3MB

Download
memory/4492-878-0x0000000000700000-0x00000000007C8000-memory.dmp

Filesize
800KB

Download
memory/4492-881-0x0000000005150000-0x00000000051E2000-memory.dmp

Filesize
584KB

Download
memory/4492-879-0x00000000057C0000-0x0000000005D64000-memory.dmp

Filesize
5.6MB

Download
memory/4708-934-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/4708-874-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/4708-867-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download