5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe
Size

441KB
MD5

fe7aee45cff1938dbb68f35a12a5f136
SHA1

108bee97f6f327c109cc0c7400f78e30a53fd83b
SHA256

5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e
SHA512

db086093dcf47fbf4df1ed0861a90d4a9b45e7755170bfbf8c8c458731c80c1ad127b90d6c798b8f65311ecbed79b048203a8cab2e51dc30181e050695a1dd27
SSDEEP

3072:vtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOLlqw1aQS0Tm2TdwnN0gUydmi:luj8NDF3OR9/Qe2HdklrSqZghdz

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 4 IoCs

resource	yara_rule
behavioral2/files/0x000a0000000231f2-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00080000000231ff-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000023203-20.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0007000000023203-52.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 64 IoCs

pid	Process
2132	casino_extensions.exe
4976	Casino_ext.exe
4760	casino_extensions.exe
4744	Casino_ext.exe
4992	casino_extensions.exe
4504	Casino_ext.exe
2228	LiveMessageCenter.exe
3800	casino_extensions.exe
1924	Casino_ext.exe
5100	LiveMessageCenter.exe
2960	casino_extensions.exe
5088	Casino_ext.exe
2988	casino_extensions.exe
1528	Casino_ext.exe
5092	casino_extensions.exe
2296	Casino_ext.exe
2604	casino_extensions.exe
3600	Casino_ext.exe
3552	casino_extensions.exe
3900	Casino_ext.exe
4980	casino_extensions.exe
4168	Casino_ext.exe
2648	casino_extensions.exe
4408	Casino_ext.exe
2584	casino_extensions.exe
4816	Casino_ext.exe
4220	casino_extensions.exe
1688	Casino_ext.exe
2368	casino_extensions.exe
4708	Casino_ext.exe
1660	LiveMessageCenter.exe
3104	casino_extensions.exe
2076	Casino_ext.exe
3096	casino_extensions.exe
5084	Casino_ext.exe
3576	casino_extensions.exe
3076	Casino_ext.exe
3820	LiveMessageCenter.exe
2012	casino_extensions.exe
4240	Casino_ext.exe
3008	casino_extensions.exe
2812	Casino_ext.exe
3660	LiveMessageCenter.exe
1216	casino_extensions.exe
2276	Casino_ext.exe
832	casino_extensions.exe
436	Casino_ext.exe
3068	casino_extensions.exe
4888	Casino_ext.exe
3052	LiveMessageCenter.exe
3252	casino_extensions.exe
2688	Casino_ext.exe
4080	casino_extensions.exe
4704	Casino_ext.exe
4512	casino_extensions.exe
1328	Casino_ext.exe
2960	casino_extensions.exe
2128	Casino_ext.exe
1212	casino_extensions.exe
4868	Casino_ext.exe
3220	casino_extensions.exe
2428	Casino_ext.exe
4596	casino_extensions.exe
116	Casino_ext.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4976	Casino_ext.exe
4976	Casino_ext.exe
4744	Casino_ext.exe
4744	Casino_ext.exe
4504	Casino_ext.exe
4504	Casino_ext.exe
2228	LiveMessageCenter.exe
2228	LiveMessageCenter.exe
1924	Casino_ext.exe
1924	Casino_ext.exe
5100	LiveMessageCenter.exe
5100	LiveMessageCenter.exe
5088	Casino_ext.exe
5088	Casino_ext.exe
1528	Casino_ext.exe
1528	Casino_ext.exe
2296	Casino_ext.exe
2296	Casino_ext.exe
3600	Casino_ext.exe
3600	Casino_ext.exe
3900	Casino_ext.exe
3900	Casino_ext.exe
4168	Casino_ext.exe
4168	Casino_ext.exe
4408	Casino_ext.exe
4408	Casino_ext.exe
4816	Casino_ext.exe
4816	Casino_ext.exe
1688	Casino_ext.exe
1688	Casino_ext.exe
4708	Casino_ext.exe
4708	Casino_ext.exe
1660	LiveMessageCenter.exe
1660	LiveMessageCenter.exe
2076	Casino_ext.exe
2076	Casino_ext.exe
5084	Casino_ext.exe
5084	Casino_ext.exe
3076	Casino_ext.exe
3076	Casino_ext.exe
3820	LiveMessageCenter.exe
3820	LiveMessageCenter.exe
4240	Casino_ext.exe
4240	Casino_ext.exe
2812	Casino_ext.exe
2812	Casino_ext.exe
3660	LiveMessageCenter.exe
3660	LiveMessageCenter.exe
2276	Casino_ext.exe
2276	Casino_ext.exe
436	Casino_ext.exe
436	Casino_ext.exe
4888	Casino_ext.exe
4888	Casino_ext.exe
3052	LiveMessageCenter.exe
3052	LiveMessageCenter.exe
2688	Casino_ext.exe
2688	Casino_ext.exe
4704	Casino_ext.exe
4704	Casino_ext.exe
1328	Casino_ext.exe
1328	Casino_ext.exe
2128	Casino_ext.exe
2128	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
964	5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 2020	964	5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe	89
PID 964 wrote to memory of 2020	964	5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe	89
PID 964 wrote to memory of 2020	964	5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe	89
PID 2020 wrote to memory of 2132	2020	casino_extensions.exe	90
PID 2020 wrote to memory of 2132	2020	casino_extensions.exe	90
PID 2020 wrote to memory of 2132	2020	casino_extensions.exe	90
PID 2132 wrote to memory of 4976	2132	casino_extensions.exe	91
PID 2132 wrote to memory of 4976	2132	casino_extensions.exe	91
PID 2132 wrote to memory of 4976	2132	casino_extensions.exe	91
PID 4976 wrote to memory of 4440	4976	Casino_ext.exe	92
PID 4976 wrote to memory of 4440	4976	Casino_ext.exe	92
PID 4976 wrote to memory of 4440	4976	Casino_ext.exe	92
PID 4440 wrote to memory of 4760	4440	casino_extensions.exe	93
PID 4440 wrote to memory of 4760	4440	casino_extensions.exe	93
PID 4440 wrote to memory of 4760	4440	casino_extensions.exe	93
PID 4760 wrote to memory of 4744	4760	casino_extensions.exe	94
PID 4760 wrote to memory of 4744	4760	casino_extensions.exe	94
PID 4760 wrote to memory of 4744	4760	casino_extensions.exe	94
PID 4744 wrote to memory of 4400	4744	Casino_ext.exe	95
PID 4744 wrote to memory of 4400	4744	Casino_ext.exe	95
PID 4744 wrote to memory of 4400	4744	Casino_ext.exe	95
PID 4400 wrote to memory of 4992	4400	casino_extensions.exe	96
PID 4400 wrote to memory of 4992	4400	casino_extensions.exe	96
PID 4400 wrote to memory of 4992	4400	casino_extensions.exe	96
PID 4992 wrote to memory of 4504	4992	casino_extensions.exe	97
PID 4992 wrote to memory of 4504	4992	casino_extensions.exe	97
PID 4992 wrote to memory of 4504	4992	casino_extensions.exe	97
PID 4504 wrote to memory of 1536	4504	Casino_ext.exe	98
PID 4504 wrote to memory of 1536	4504	Casino_ext.exe	98
PID 4504 wrote to memory of 1536	4504	Casino_ext.exe	98
PID 1536 wrote to memory of 2228	1536	casino_extensions.exe	99
PID 1536 wrote to memory of 2228	1536	casino_extensions.exe	99
PID 1536 wrote to memory of 2228	1536	casino_extensions.exe	99
PID 2228 wrote to memory of 2100	2228	LiveMessageCenter.exe	100
PID 2228 wrote to memory of 2100	2228	LiveMessageCenter.exe	100
PID 2228 wrote to memory of 2100	2228	LiveMessageCenter.exe	100
PID 2100 wrote to memory of 3800	2100	casino_extensions.exe	101
PID 2100 wrote to memory of 3800	2100	casino_extensions.exe	101
PID 2100 wrote to memory of 3800	2100	casino_extensions.exe	101
PID 3800 wrote to memory of 1924	3800	casino_extensions.exe	102
PID 3800 wrote to memory of 1924	3800	casino_extensions.exe	102
PID 3800 wrote to memory of 1924	3800	casino_extensions.exe	102
PID 1924 wrote to memory of 912	1924	Casino_ext.exe	103
PID 1924 wrote to memory of 912	1924	Casino_ext.exe	103
PID 1924 wrote to memory of 912	1924	Casino_ext.exe	103
PID 912 wrote to memory of 5100	912	casino_extensions.exe	104
PID 912 wrote to memory of 5100	912	casino_extensions.exe	104
PID 912 wrote to memory of 5100	912	casino_extensions.exe	104
PID 5100 wrote to memory of 4736	5100	LiveMessageCenter.exe	105
PID 5100 wrote to memory of 4736	5100	LiveMessageCenter.exe	105
PID 5100 wrote to memory of 4736	5100	LiveMessageCenter.exe	105
PID 4736 wrote to memory of 2960	4736	casino_extensions.exe	106
PID 4736 wrote to memory of 2960	4736	casino_extensions.exe	106
PID 4736 wrote to memory of 2960	4736	casino_extensions.exe	106
PID 2960 wrote to memory of 5088	2960	casino_extensions.exe	107
PID 2960 wrote to memory of 5088	2960	casino_extensions.exe	107
PID 2960 wrote to memory of 5088	2960	casino_extensions.exe	107
PID 5088 wrote to memory of 792	5088	Casino_ext.exe	108
PID 5088 wrote to memory of 792	5088	Casino_ext.exe	108
PID 5088 wrote to memory of 792	5088	Casino_ext.exe	108
PID 792 wrote to memory of 2988	792	casino_extensions.exe	109
PID 792 wrote to memory of 2988	792	casino_extensions.exe	109
PID 792 wrote to memory of 2988	792	casino_extensions.exe	109
PID 2988 wrote to memory of 1528	2988	casino_extensions.exe	110

C:\Users\Admin\AppData\Local\Temp\5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe
"C:\Users\Admin\AppData\Local\Temp\5cb5559a700828403a139bb02c6cd19ec02501368109292f4838e108b305620e.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4440
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        11⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        12⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        13⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        14⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        16⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        17⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        18⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        19⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        20⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        21⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        23⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1528
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        24⤵
        Drops file in System32 directory
        
        PID:5028
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        25⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        27⤵
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        28⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        29⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3600
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        30⤵
        Drops file in System32 directory
        
        PID:2056
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        31⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3552
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        32⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3900
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        33⤵
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        34⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4980
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        35⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4168
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        36⤵
        Drops file in System32 directory
        
        PID:4436
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        37⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        38⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4408
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        39⤵
        Drops file in System32 directory
        
        PID:4664
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        40⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2584
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        41⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4816
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        42⤵
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        43⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        44⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1688
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        45⤵
        Drops file in System32 directory
        
        PID:860
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        46⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        47⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        48⤵
        Drops file in System32 directory
        
        PID:3460
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        49⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        50⤵
        Drops file in System32 directory
        
        PID:1652
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        51⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3104
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        52⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2076
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        53⤵
        Drops file in System32 directory
        
        PID:3468
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        54⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3096
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        55⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5084
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        56⤵
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        57⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        58⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3076
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        59⤵
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        60⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3820
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        61⤵
        Drops file in System32 directory
        
        PID:408
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        62⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2012
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        63⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4240
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        64⤵
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        65⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3008
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        66⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        67⤵
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        68⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3660
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        69⤵
        Drops file in System32 directory
        
        PID:4044
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        70⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        71⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2276
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        72⤵
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        73⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        74⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:436
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        75⤵
        Drops file in System32 directory
        
        PID:4760
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        76⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        77⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4888
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        78⤵
        Drops file in System32 directory
        
        PID:4524
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        79⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        80⤵
        Drops file in System32 directory
        
        PID:2704
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        81⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        82⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2688
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        83⤵
        Drops file in System32 directory
        
        PID:4864
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        84⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4080
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        85⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        86⤵
        Drops file in System32 directory
        
        PID:5024
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        87⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        88⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1328
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        89⤵
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        90⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2960
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        91⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2128
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        92⤵
        Drops file in System32 directory
        
        PID:792
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        93⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1212
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        94⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4868
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        95⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        96⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3220
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        97⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2428
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        98⤵
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        99⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        100⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:116
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        101⤵
        Drops file in System32 directory
        
        PID:4988
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        102⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        103⤵
        Drops file in Program Files directory
        
        PID:3900
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        104⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        105⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        106⤵
        Drops file in Program Files directory
        
        PID:4032
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        107⤵
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        108⤵
        Drops file in Program Files directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        109⤵
        Drops file in Program Files directory
        
        PID:4404
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        110⤵
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        111⤵
        Drops file in Program Files directory
        
        PID:2648
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        112⤵
        Drops file in Program Files directory
        
        PID:1144
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        113⤵
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        114⤵
        
        PID:532
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        115⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        116⤵
        Drops file in Program Files directory
        
        PID:4816
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        117⤵
        Drops file in Program Files directory
        
        PID:2956
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        118⤵
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        119⤵
        Drops file in Program Files directory
        
        PID:4220
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        120⤵
        
        PID:1388
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        121⤵
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        122⤵
        Drops file in Program Files directory
        
        PID:2368
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        123⤵
        Drops file in Program Files directory
        
        PID:3224
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        124⤵
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        125⤵
        Drops file in Program Files directory
        
        PID:1660
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        126⤵
        
        PID:4412
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        127⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        128⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        129⤵
        Drops file in Program Files directory
        
        PID:3592
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        130⤵
        Drops file in System32 directory
        
        PID:2800
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        131⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        132⤵
        Drops file in Program Files directory
        
        PID:3096
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        133⤵
        Drops file in System32 directory
        
        PID:944
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        134⤵
        Drops file in Program Files directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        135⤵
        
        PID:1964
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        136⤵
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        137⤵
        Drops file in Program Files directory
        
        PID:4364
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        138⤵
        
        PID:1464
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        139⤵
        Drops file in System32 directory
        
        PID:2632
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        140⤵
        Drops file in Program Files directory
        
        PID:408
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        141⤵
        
        PID:4984
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        142⤵
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        143⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        144⤵
        Drops file in Program Files directory
        
        PID:1084
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        145⤵
        Drops file in System32 directory
        
        PID:1344
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe
        146⤵
        Drops file in Program Files directory
        
        PID:1384
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        147⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c $$2028~1.BAT
        148⤵
        
        PID:3732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
458KB

MD5
dc4789b427b5a8ed988fdf265cf86295

SHA1
b518c09862b5c074545b3f3f2f6fcd0443cfddfe

SHA256
49ce9bbc9cfc4cb4afee301aaf06b604945da3f2978bebc2f16f57a12c68b06a

SHA512
6270fa5c58e0c1326d8d80cd7508087624ce325025c553e2f9055bd2be319b203a2e8b310c7aab75864034a0b62a6667aaf00dda717f736d5a94329a340b9ba2

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
447KB

MD5
d2bb903c5d2339072108ce4b73844ead

SHA1
fcda817982141ac907d06ffb756c695ce2df6440

SHA256
263ef69b07e8f69fa40b9398434960f388ec8d818cd584f22acd894a1f7344e7

SHA512
003c5f43b1c4b94f736e0d5b7388dee037907c3f103627304c27f8decf935201670f6c1c94e109d9433b36b322d38d0816c86a9e2e4df526cffd3adb7b61d183

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
448KB

MD5
0352d97776257a6552b862b69e73b12f

SHA1
131dc5a92d457c97cee47c488e9b81660f1634da

SHA256
fe1d9655e277d216375c6b8d67e9d778b4e680717da979393c148467aaa81c58

SHA512
bf5db9c792e15eecd0f9304501830e2ac38e9a750df1a785e495e8c1b39d9424e0843ea5dd234055c4f45a9e7dd61da56c173d53bf29a4756dec1866bbe1e169

Download Submit