lumma | 8e938e1b74eb68ee2b1061b30c8290b08c0d64b93cbc193c84ee963237a431e2

Analysis

max time kernel
160s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
Size

543KB
MD5

fd6b82855a5dee211180e8e2acfe61c2
SHA1

74fff0793248cc7eb65bd423799e8bb89dd5dde2
SHA256

8e938e1b74eb68ee2b1061b30c8290b08c0d64b93cbc193c84ee963237a431e2
SHA512

f22e05167c16978d72d8db0724cd7f81434c64001cf46add0e90daae5b9b2c5bafcb23ae421b4675b6c86ec903abc68a151dd97d69d7170d1b97bc49b6a606c2
SSDEEP

12288:GDflNwb6MUmxpbMXesgag6sXMZG/wL9SFkmbgbNBELtL:Elk3xdR56sXCaWQNbeNiJ

Score

10^/10

lumma stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 64 IoCs

Processes:

resource	yara_rule
behavioral2/memory/404-6-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-7-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-8-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-9-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-10-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-11-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-12-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-13-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-14-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-15-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-16-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-17-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-18-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-19-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-20-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-22-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-23-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-24-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-25-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-26-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-21-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-27-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-28-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-29-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-30-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-31-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-32-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-33-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-34-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-35-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-36-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-38-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-39-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-40-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-37-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-42-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-43-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-45-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-46-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-48-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-50-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-51-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-53-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-55-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-57-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-60-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-61-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-63-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-64-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-62-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-59-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-58-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-56-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-54-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-52-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-49-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-47-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-44-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-41-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/404-249-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/4348-380-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/3644-568-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/3620-756-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4
behavioral2/memory/4464-944-0x0000000000400000-0x000000000065D000-memory.dmp	family_lumma_v4

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Executes dropped EXE 12 IoCs

Processes:

adasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exe

pid	process
3544	adasoftw.exe
4348	adasoftw.exe
1552	adasoftw.exe
3644	adasoftw.exe
5028	adasoftw.exe
3620	adasoftw.exe
5032	adasoftw.exe
4464	adasoftw.exe
2036	adasoftw.exe
2208	adasoftw.exe
32	adasoftw.exe
4956	adasoftw.exe

Drops file in System32 directory 14 IoCs

Processes:

adasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exefd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exeadasoftw.exeadasoftw.exe

description	ioc	process
File created	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File created	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File created	C:\Windows\SysWOW64\adasoftw.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File created	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File created	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File created	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File created	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe
File opened for modification	C:\Windows\SysWOW64\adasoftw.exe	adasoftw.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exe

description	pid	process	target process
PID 4112 set thread context of 404	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 3544 set thread context of 4348	3544	adasoftw.exe	adasoftw.exe
PID 1552 set thread context of 3644	1552	adasoftw.exe	adasoftw.exe
PID 5028 set thread context of 3620	5028	adasoftw.exe	adasoftw.exe
PID 5032 set thread context of 4464	5032	adasoftw.exe	adasoftw.exe
PID 2036 set thread context of 2208	2036	adasoftw.exe	adasoftw.exe
PID 32 set thread context of 4956	32	adasoftw.exe	adasoftw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exefd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exeadasoftw.exe

description	pid	process	target process
PID 4112 wrote to memory of 4028	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 4028	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 4028	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 404	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 404	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 404	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 404	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 4112 wrote to memory of 404	4112	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
PID 404 wrote to memory of 3544	404	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	adasoftw.exe
PID 404 wrote to memory of 3544	404	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	adasoftw.exe
PID 404 wrote to memory of 3544	404	fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe	adasoftw.exe
PID 3544 wrote to memory of 4320	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4320	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4320	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4348	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4348	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4348	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4348	3544	adasoftw.exe	adasoftw.exe
PID 3544 wrote to memory of 4348	3544	adasoftw.exe	adasoftw.exe
PID 4348 wrote to memory of 1552	4348	adasoftw.exe	adasoftw.exe
PID 4348 wrote to memory of 1552	4348	adasoftw.exe	adasoftw.exe
PID 4348 wrote to memory of 1552	4348	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3968	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3968	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3968	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3644	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3644	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3644	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3644	1552	adasoftw.exe	adasoftw.exe
PID 1552 wrote to memory of 3644	1552	adasoftw.exe	adasoftw.exe
PID 3644 wrote to memory of 5028	3644	adasoftw.exe	adasoftw.exe
PID 3644 wrote to memory of 5028	3644	adasoftw.exe	adasoftw.exe
PID 3644 wrote to memory of 5028	3644	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 2356	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 2356	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 2356	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 3620	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 3620	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 3620	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 3620	5028	adasoftw.exe	adasoftw.exe
PID 5028 wrote to memory of 3620	5028	adasoftw.exe	adasoftw.exe
PID 3620 wrote to memory of 5032	3620	adasoftw.exe	adasoftw.exe
PID 3620 wrote to memory of 5032	3620	adasoftw.exe	adasoftw.exe
PID 3620 wrote to memory of 5032	3620	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 8	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 8	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 8	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 4464	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 4464	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 4464	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 4464	5032	adasoftw.exe	adasoftw.exe
PID 5032 wrote to memory of 4464	5032	adasoftw.exe	adasoftw.exe
PID 4464 wrote to memory of 2036	4464	adasoftw.exe	adasoftw.exe
PID 4464 wrote to memory of 2036	4464	adasoftw.exe	adasoftw.exe
PID 4464 wrote to memory of 2036	4464	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2824	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2824	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2824	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2208	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2208	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2208	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2208	2036	adasoftw.exe	adasoftw.exe
PID 2036 wrote to memory of 2208	2036	adasoftw.exe	adasoftw.exe
PID 2208 wrote to memory of 32	2208	adasoftw.exe	adasoftw.exe

C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4112

C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
2⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\system32\adasoftw.exe 1100 "C:\Users\Admin\AppData\Local\Temp\fd6b82855a5dee211180e8e2acfe61c2_JaffaCakes118.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
4⤵
PID:4320

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4348

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\system32\adasoftw.exe 1100 "C:\Windows\SysWOW64\adasoftw.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
6⤵
PID:3968

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\system32\adasoftw.exe 1100 "C:\Windows\SysWOW64\adasoftw.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
8⤵
PID:2356

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3620

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\system32\adasoftw.exe 1100 "C:\Windows\SysWOW64\adasoftw.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
10⤵
PID:8

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\system32\adasoftw.exe 1088 "C:\Windows\SysWOW64\adasoftw.exe"
11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
12⤵
PID:2824

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2208

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\system32\adasoftw.exe 1100 "C:\Windows\SysWOW64\adasoftw.exe"
13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:32

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
14⤵
PID:2912

C:\Windows\SysWOW64\adasoftw.exe
C:\Windows\SysWOW64\adasoftw.exe
14⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:3428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\adasoftw.exe
Filesize
543KB

MD5
fd6b82855a5dee211180e8e2acfe61c2

SHA1
74fff0793248cc7eb65bd423799e8bb89dd5dde2

SHA256
8e938e1b74eb68ee2b1061b30c8290b08c0d64b93cbc193c84ee963237a431e2

SHA512
f22e05167c16978d72d8db0724cd7f81434c64001cf46add0e90daae5b9b2c5bafcb23ae421b4675b6c86ec903abc68a151dd97d69d7170d1b97bc49b6a606c2

Download Submit
memory/404-37-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-61-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-5-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-6-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-7-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-8-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-9-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-10-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-11-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-12-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-13-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-14-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-15-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-16-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-17-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-40-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-19-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-20-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-22-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-23-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-24-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-25-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-26-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-21-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-27-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-28-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-29-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-30-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-31-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-32-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-33-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-34-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-35-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-36-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-38-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-39-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-18-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-1-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-4-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-43-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-45-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-46-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-48-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-50-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-51-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-53-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-55-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-57-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-60-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-42-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-63-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-64-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-62-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-59-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-58-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-56-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-54-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-52-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-49-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-47-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-44-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-41-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/404-249-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/2208-950-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/2208-1132-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3620-574-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3620-756-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3644-386-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3644-568-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/4112-0-0x0000000002000000-0x000000000208E7FC-memory.dmp

Filesize
569KB

Download
memory/4112-2-0x0000000002000000-0x000000000208E7FC-memory.dmp

Filesize
569KB

Download
memory/4348-197-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/4348-380-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/4464-762-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/4464-944-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download