2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe
Size

419KB
MD5

2bb5ad04b72fcaae14ff3f467e2e6396
SHA1

b90b219b3480dd90f6f0ce3ac6bd24245bd5c8d7
SHA256

2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4
SHA512

c8ff456bf5a63d3720312f39e5c6e8217ec90b7f5167e6e98c46a40169ebf9d964eca14bbb47df28efb2d50322fac140f79f4d62013e8e8de82e13d7236fbfcf
SSDEEP

3072:XtwizQTj8CSUYf8W3nSjen++Bj88OZS0/Qe2HdOLlqw1aQ2c1HdLmkbbCBwx5:duj8NDF3OR9/Qe2HdklrtDEwx5

Score

9^/10

Malware Config

Signatures

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e9a0-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d000000023149-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a000000023208-36.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 25 IoCs

pid	Process
3288	casino_extensions.exe
4476	Casino_ext.exe
2712	casino_extensions.exe
3900	Casino_ext.exe
1104	casino_extensions.exe
2836	Casino_ext.exe
4980	casino_extensions.exe
2056	Casino_ext.exe
4020	casino_extensions.exe
4584	Casino_ext.exe
4976	casino_extensions.exe
4000	Casino_ext.exe
4632	casino_extensions.exe
1340	Casino_ext.exe
3116	casino_extensions.exe
2308	Casino_ext.exe
4780	casino_extensions.exe
4576	Casino_ext.exe
3480	casino_extensions.exe
2480	Casino_ext.exe
4236	casino_extensions.exe
1628	Casino_ext.exe
3728	LiveMessageCenter.exe
1588	casino_extensions.exe
4284	Casino_ext.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File created	C:\Windows\SysWOW64\LiveMessageCenter.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Windows\SysWOW64\casino_extensions.exe	casino_extensions.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File created	C:\Program Files (x86)\Internet Explorer\$$202803s.bat	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	casino_extensions.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	Casino_ext.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\casino_extensions.exe	LiveMessageCenter.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4476	Casino_ext.exe
4476	Casino_ext.exe
3900	Casino_ext.exe
3900	Casino_ext.exe
2836	Casino_ext.exe
2836	Casino_ext.exe
2056	Casino_ext.exe
2056	Casino_ext.exe
4584	Casino_ext.exe
4584	Casino_ext.exe
4000	Casino_ext.exe
4000	Casino_ext.exe
1340	Casino_ext.exe
1340	Casino_ext.exe
2308	Casino_ext.exe
2308	Casino_ext.exe
4576	Casino_ext.exe
4576	Casino_ext.exe
2480	Casino_ext.exe
2480	Casino_ext.exe
1628	Casino_ext.exe
1628	Casino_ext.exe
3728	LiveMessageCenter.exe
3728	LiveMessageCenter.exe
4284	Casino_ext.exe
4284	Casino_ext.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1396	2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2312	1396	2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe	89
PID 1396 wrote to memory of 2312	1396	2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe	89
PID 1396 wrote to memory of 2312	1396	2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe	89
PID 2312 wrote to memory of 3288	2312	casino_extensions.exe	90
PID 2312 wrote to memory of 3288	2312	casino_extensions.exe	90
PID 2312 wrote to memory of 3288	2312	casino_extensions.exe	90
PID 3288 wrote to memory of 4476	3288	casino_extensions.exe	91
PID 3288 wrote to memory of 4476	3288	casino_extensions.exe	91
PID 3288 wrote to memory of 4476	3288	casino_extensions.exe	91
PID 4476 wrote to memory of 2604	4476	Casino_ext.exe	92
PID 4476 wrote to memory of 2604	4476	Casino_ext.exe	92
PID 4476 wrote to memory of 2604	4476	Casino_ext.exe	92
PID 2604 wrote to memory of 2712	2604	casino_extensions.exe	93
PID 2604 wrote to memory of 2712	2604	casino_extensions.exe	93
PID 2604 wrote to memory of 2712	2604	casino_extensions.exe	93
PID 2712 wrote to memory of 3900	2712	casino_extensions.exe	94
PID 2712 wrote to memory of 3900	2712	casino_extensions.exe	94
PID 2712 wrote to memory of 3900	2712	casino_extensions.exe	94
PID 3900 wrote to memory of 3604	3900	Casino_ext.exe	95
PID 3900 wrote to memory of 3604	3900	Casino_ext.exe	95
PID 3900 wrote to memory of 3604	3900	Casino_ext.exe	95
PID 3604 wrote to memory of 1104	3604	casino_extensions.exe	96
PID 3604 wrote to memory of 1104	3604	casino_extensions.exe	96
PID 3604 wrote to memory of 1104	3604	casino_extensions.exe	96
PID 1104 wrote to memory of 2836	1104	casino_extensions.exe	97
PID 1104 wrote to memory of 2836	1104	casino_extensions.exe	97
PID 1104 wrote to memory of 2836	1104	casino_extensions.exe	97
PID 2836 wrote to memory of 3428	2836	Casino_ext.exe	98
PID 2836 wrote to memory of 3428	2836	Casino_ext.exe	98
PID 2836 wrote to memory of 3428	2836	Casino_ext.exe	98
PID 3428 wrote to memory of 4980	3428	casino_extensions.exe	99
PID 3428 wrote to memory of 4980	3428	casino_extensions.exe	99
PID 3428 wrote to memory of 4980	3428	casino_extensions.exe	99
PID 4980 wrote to memory of 2056	4980	casino_extensions.exe	100
PID 4980 wrote to memory of 2056	4980	casino_extensions.exe	100
PID 4980 wrote to memory of 2056	4980	casino_extensions.exe	100
PID 2056 wrote to memory of 812	2056	Casino_ext.exe	101
PID 2056 wrote to memory of 812	2056	Casino_ext.exe	101
PID 2056 wrote to memory of 812	2056	Casino_ext.exe	101
PID 812 wrote to memory of 4020	812	casino_extensions.exe	102
PID 812 wrote to memory of 4020	812	casino_extensions.exe	102
PID 812 wrote to memory of 4020	812	casino_extensions.exe	102
PID 4020 wrote to memory of 4584	4020	casino_extensions.exe	103
PID 4020 wrote to memory of 4584	4020	casino_extensions.exe	103
PID 4020 wrote to memory of 4584	4020	casino_extensions.exe	103
PID 4584 wrote to memory of 2884	4584	Casino_ext.exe	104
PID 4584 wrote to memory of 2884	4584	Casino_ext.exe	104
PID 4584 wrote to memory of 2884	4584	Casino_ext.exe	104
PID 2884 wrote to memory of 4976	2884	casino_extensions.exe	105
PID 2884 wrote to memory of 4976	2884	casino_extensions.exe	105
PID 2884 wrote to memory of 4976	2884	casino_extensions.exe	105
PID 4976 wrote to memory of 4000	4976	casino_extensions.exe	106
PID 4976 wrote to memory of 4000	4976	casino_extensions.exe	106
PID 4976 wrote to memory of 4000	4976	casino_extensions.exe	106
PID 4000 wrote to memory of 4468	4000	Casino_ext.exe	107
PID 4000 wrote to memory of 4468	4000	Casino_ext.exe	107
PID 4000 wrote to memory of 4468	4000	Casino_ext.exe	107
PID 4468 wrote to memory of 4632	4468	casino_extensions.exe	108
PID 4468 wrote to memory of 4632	4468	casino_extensions.exe	108
PID 4468 wrote to memory of 4632	4468	casino_extensions.exe	108
PID 4632 wrote to memory of 1340	4632	casino_extensions.exe	109
PID 4632 wrote to memory of 1340	4632	casino_extensions.exe	109
PID 4632 wrote to memory of 1340	4632	casino_extensions.exe	109
PID 1340 wrote to memory of 4456	1340	Casino_ext.exe	110

C:\Users\Admin\AppData\Local\Temp\2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe
"C:\Users\Admin\AppData\Local\Temp\2d6c318fff9788e303fa7445ea97b75eef6e6a2a5e95ab388ef0f86391379da4.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
  "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\casino_extensions.exe
    C:\Windows\system32\casino_extensions.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\SysWOW64\Casino_ext.exe
      C:\Windows\SysWOW64\Casino_ext.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2604
      - C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2712
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        8⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        9⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1104
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        10⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        11⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        12⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        13⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        14⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        15⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        16⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        17⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        18⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        19⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        20⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        21⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        22⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        23⤵
        Drops file in System32 directory
        
        PID:4456
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        24⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3116
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        25⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2308
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        26⤵
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        27⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        28⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4576
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        29⤵
        Drops file in System32 directory
        
        PID:1888
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        30⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:3480
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        31⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2480
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        32⤵
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        33⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:4236
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        34⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1628
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        35⤵
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\LiveMessageCenter.exe
        
        C:\Windows\system32\LiveMessageCenter.exe /part2
        36⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3728
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        37⤵
        Drops file in System32 directory
        
        PID:320
        
        C:\Windows\SysWOW64\casino_extensions.exe
        
        C:\Windows\system32\casino_extensions.exe
        38⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1588
        
        C:\Windows\SysWOW64\Casino_ext.exe
        
        C:\Windows\SysWOW64\Casino_ext.exe
        39⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:4284
        
        C:\Program Files (x86)\Internet Explorer\casino_extensions.exe
        
        "C:\Program Files (x86)\Internet Explorer\casino_extensions.exe"
        40⤵
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c $$2028~1.BAT
        41⤵
        
        PID:3752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\$$202803s.bat

Filesize
81B

MD5
4777bf695815d870d27ed4a38a8f0840

SHA1
565412b5182bca7a221448dba78369c42d1c4a0c

SHA256
c08018226d9a45ab277a01ca35f519ff7ea1cb450d080e24b0f590739654241d

SHA512
87e792d326c5a9d2d92984ec4c34d2af9d616a4676a7d69df73b09975fd077d96077ae2528b6fc05752110eb4e406c3e9d94d49d0a74eeaba6bc6a48bca8ac1d

Download Submit
C:\Windows\SysWOW64\LiveMessageCenter.exe

Filesize
425KB

MD5
297284c0e36ee7cef1d301e430ec0357

SHA1
0d631a249cc226c3ff79f06b1fe0644ea8342536

SHA256
d1c077521117dbae451fc0fd702739c1d757eff6aa1fcdc29fa9599f7ca4a2ef

SHA512
28cb2e2e7126e3dbf22ef60d88575416d77b63468e48de92417daf2373632d016d934aaaa36fd13e0ef54d135924e65430e98b12ad6d599746242d0e6a7b445f

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
434KB

MD5
634059cfe1607123c8043f3a8b783c3e

SHA1
5c7410c3f2b03c649a7a304c633761ccd2c28191

SHA256
863c37c358ec34b7ca2b68b99fb2082a040692c64cd752d693ad15574ee2a8c4

SHA512
0854bf3faaff74b1eb3495e6aa981fa8785759db6dd60b3368e045afa8f6fbc994d216657c41e5fba1e67ffc6127c37637a1536a5f9d5f5415c56e169a0c13b0

Download Submit
C:\Windows\SysWOW64\casino_extensions.exe

Filesize
426KB

MD5
3dead122bc2fc4170ec23dee4af4014c

SHA1
a0330414b9aac994f27850100bd36d3f44bc49de

SHA256
477b5cc1c733623ccb9dff37c6e966d66c765a05f999d07c77cd610cad76c6ff

SHA512
67d629537741fe2ebfdcc9e6cd5abc70274291934e20d8b6c94f989e95be310abf8cce55a02f913ce47ec5d3f3fa215641620d46695aba4be977200f49d00794

Download Submit